CVE-2026-105945 Apache Software Foundation CVE debrief

Who should care

Defenders responsible for Apache Pulsar deployments, especially those using filesystem package storage, should assess exposure and prioritize patching to prevent cross-tenant package access.

Why it matters

CVE-2026-105945 allows cross-tenant package access in Apache Pulsar's filesystem package storage. Defenders should verify and apply patches, assess exposure, and restrict access to sensitive namespaces.

• Potential unauthorized package access and modification across tenants
• Possible integrity and availability impacts on Pulsar Functions, Sources, or Sinks
• Need for verification of affected versions and exposure in environments
• Priority on patching and restricting access to sensitive namespaces

Technical summary

The Apache Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker. Due to improper validation of package name components, an authenticated user with packages permission on any namespace could download, overwrite, or delete packages stored in other tenants or namespaces for which the user has no permission. The issue arises from the version component of a package name not being validated, allowing URL-encoded path separators and parent directory references. This can lead to unauthorized access, modification, or deletion of packages across tenants.

Defensive priority

Defenders should prioritize verifying and applying patches for Apache Pulsar, especially for versions 2.10.0 to 4.0.14 and 4.1.0 to 4.2.5, and assess exposure in their environments.

Recommended defensive actions

• Verify and apply patches for Apache Pulsar versions 2.10.0 to 4.0.14 and 4.1.0 to 4.2.5
• Assess exposure in environments using Apache Pulsar
• Restrict access to sensitive namespaces and tenants
• Monitor for suspicious package operations
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability in Apache Pulsar, including its impact on cross-tenant package access in filesystem package storage. The vulnerability is caused by the improper validation of package name components, specifically the version component, which can contain URL-encoded path separators and parent directory references. This allows an authenticated user to access packages stored in other tenants or namespaces. The source item and CVE record provide evidence of the vulnerability and its The

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.