CVE-2026-105937: Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger
This Apache advisory covers CVE-2026-105937 in Apache Pulsar.
- CVE-2026-105937
Key facts
- Vendor rating
- High, CVSS 8.7
- CISA KEV
- Not listed (catalogue checked )
- Affected
- 3.0.0 before 4.0.14; 4.1.0 before 4.2.5
- Fixed in
- 4.0.14, 4.2.5
- Source published
- Source revised
- Listed by VulniPulse
- Record changed
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting the reserved topic property PULSAR.SHADOW_SOURCE.
The admin REST API accepts this property when creating a non-partitioned or partitioned topic and when updating the properties of an existing topic. On these paths the broker authorizes the caller only against the topic being created or updated.
It does not authorize the caller against the source topic named in the property. The existing authorization for shadow topic configuration (the SHADOW_TOPIC topic policy on the source topic) is applied only to the source-side shadow topics admin API, not to these paths.
As a result, an authenticated user who is allowed to create topics or update topic properties in one tenant can bind a topic in that tenant to a persistent topic in any other tenant. With the default authorization provider, these operations require the tenant admin role for the user's own tenant.
The user does not need any permission on the source topic, its namespace or its tenant. This impact analysis assumes that Pulsar has been configured with the default authorization provider.
For custom authorization providers, the impact could be different.
Text from the source record.
- 3.0.0 before 4.0.14
- 4.1.0 before 4.2.5
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-105937
Upgrade to a fixed release named by Apache:
- 4.0.14
- 4.2.5
Vendor guidance
- As a result, an authenticated user who is allowed to create topics or update topic properties in one tenant can bind a topic in that tenant to a persistent topic in any other tenant.
- Apache Pulsar 2.x releases do not contain the shadow topic implementation. - 4.0.x version users should upgrade to at least 4.0.14. - 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.
- Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
- Users who cannot upgrade immediately can reduce exposure by granting the tenant admin role only to trusted principals.
More Apache Software Foundation advisories
CVE-2026-105945Oct 21, 2026Apache Pulsar: The Pulsar Packages Management ServiceCVE-2026-105942Oct 21, 2026Apache Pulsar: When a configured proxy role sends a request to the broker on behalfCVE-2026-105938Oct 21, 2026Apache Pulsar namespaces can restrictCVE-2026-105936Oct 21, 2026Apache Pulsar: The Pulsar Functions worker REST API provides two endpointsCVE-2026-105935Oct 21, 2026Apache Pulsar: The Pulsar Functions Worker provides a REST API endpoint for triggeringCVE-2026-105934Oct 21, 2026The Apache Pulsar broker admin REST API provides a truncate operation for persistent
Apache Software Foundation advisories, October 2026All Apache Software Foundation advisories
Get an email when Apache Messaging (ActiveMQ/Kafka/Pulsar) publishes the next one.
See Apache Messaging (ActiveMQ/Kafka/Pulsar)'s last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Apache Software Foundation CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
