Low [CVE-2026-105932] The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic
This low-severity Apache Software Foundation advisory covers CVE-2026-105932 affecting Apache Pulsar.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persistent topics these endpoints check that the caller is authorized for the entry filters topic policy operation.
The corresponding endpoints for non-persistent topics (/admin/v2/non-persistent/{tenant}/{namespace}/{topic}/entryFilters) do not perform this authorization check. The only authorization check these endpoints perform is an indirect lookup permission check, made while the topic's partition metadata is retrieved; it is present in all affected versions.
As a result, when authentication and authorization are enabled, an authenticated user who has been granted produce or consume permission on a non-persistent topic, or on its namespace, but not permission to manage the topic's policies can read, replace or remove the topic-level entry filter policy of that topic.
These operations should be restricted to users with the tenant admin role or the superuser role. This impact analysis assumes that Pulsar has been configured with the default authorization provider.
For custom authorization providers, the impact could be slightly different.
The practical impact is limited by two broker configuration requirements, neither of which is met by default:
- 3.3.0 before 4.0.14
- 4.1.0 before 4.2.5
Official advisory · high-confidence parse· fetched 12 hours ago·verify at source
- 4.0.14
- 4.2.5
- 3.3.0
Official advisory · high-confidence parse· fetched 12 hours ago·verify at source
Mitigation checklist
- The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic.
- As a result, when authentication and authorization are enabled, an authenticated user who has been granted produce or consume permission on a non-persistent topic, or on its namespace, but not permission to manage the topic's policies can read, replace or remove the topic-level entry filter policy of that topic.
- The issue does not allow a caller to install or load entry filter code or to run arbitrary code in the broker. - Topic-level entry filter policies must be allowed to override the broker-level configuration (allowOverrideEntryFilters, which is disabled by default).
- This issue affects Apache Pulsar versions from 3.3.0 before 4.0.14 and from 4.1.0 before 4.2.5. - 3.3.x and 4.0.x version users should upgrade to at least 4.0.14. - 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.
- Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
- Users who cannot upgrade immediately and have deployed entry filters should keep allowOverrideEntryFilters at its default value of false, so that topic-level entry filter policies do not affect message dispatch.
- In deployments where both conditions are met, an unauthorized user can remove the topic-level entry filter policy of a non-persistent topic, for example one used to restrict which messages are delivered to consumers, or apply a different installed entry filter that withholds messages from subscriptions of that topic.
Official advisory · high-confidence parse· fetched 12 hours ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.