Skip to content
VulniPulse
Sign in
Advisory severityLow2.3Apache Software Foundation Updated

Low [CVE-2026-105938] Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or by granting permission on a subscription to specific roles

This low-severity Apache Software Foundation advisory covers CVE-2026-105938 affecting Apache Pulsar.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-105938 Source published Source updated

VulniPulse record published Record updated

CVE-2026-105938
Affected products & platforms
Apache Software FoundationMessaging
Open source advisory

Android app · Google Play

Monitor future Apache Software Foundation CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features

Summary

Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or by granting permission on a subscription to specific roles.

Topic-level subscription operations, such as consuming, skipping messages, resetting a cursor or deleting a subscription, apply these subscription policies. Several admin REST API operations that act on subscriptions did not apply them:

  • the namespace-level and bundle-level clear backlog operations, both for a named subscription and for all subscriptions;
  • the topic-level operation that expires messages for all subscriptions of a topic.

With the default authorization provider, the namespace-level operations require only consume permission granted on the namespace, and the expire-all operation requires only consume permission on the topic.

As a result, when authentication and authorization are enabled and a namespace uses the Prefix subscription authentication mode or subscription permissions, an authenticated user with such consume permission can clear the backlog of, expire messages of, or delete a subscription that the policies would deny to that user.

Tenant admin or superuser access is not required.

Affected versions
  • 2.8.0 before 4.0.14
  • 4.1.0 before 4.2.5

Official advisory · high-confidence parse· fetched 12 hours ago·verify at source

Fixed versions
  • 4.0.14
  • 4.2.5

Official advisory · high-confidence parse· fetched 12 hours ago·verify at source

Mitigation checklist

Recommended fix / mitigation
  • Topic-level subscription operations, such as consuming, skipping messages, resetting a cursor or deleting a subscription, apply these subscription policies.
  • Several admin REST API operations that act on subscriptions did not apply them: - the namespace-level and bundle-level clear backlog operations, both for a named subscription and for all subscriptions; - the namespace-level and bundle-level unsubscribe operations; - the topic-level operation that expires messages for all subscriptions of a topic.
  • Deployments that do not configure the Prefix subscription authentication mode or subscription permissions (the defaults) are not affected by this bypass, because consume permission on the namespace or topic already allows these operations there.
  • In fixed versions, the namespace-level and bundle-level operations for a named subscription apply the subscription policies to that subscription, and the operations for all subscriptions, when requested by a user who is not a tenant admin or superuser, only act on the subscriptions that the user may access.
  • Topic-level subscription operations apply the subscription policies for all types of authentication data, including that of the anonymous user role.
  • This issue affects Apache Pulsar versions from 2.8.0 before 4.0.14 and from 4.1.0 before 4.2.5. - 4.0.x version users should upgrade to at least 4.0.14. - 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.
  • All brokers in a cluster must be upgraded before relying on the namespace-level restrictions, because brokers that have not been upgraded do not apply them when they receive the internal per-bundle requests.
  • Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
Temporary workarounds
  • Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or by granting permission on a subscription to specific roles.

Official advisory · high-confidence parse· fetched 12 hours ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Sign in to join the discussion.