What’s Vulnerable › Products
Apache Software Foundation Apache Pulsar vulnerabilities
34 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.
Check whether your Apache Software Foundation Apache Pulsar version is affected
Latest Apache Software Foundation Apache Pulsar vulnerabilities
- CVE-2026-105945 — Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage (CVSS 7.7)
- CVE-2026-105927 — Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission (CVSS 2.3)
- CVE-2026-105926 — Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands (CVSS 5.3)
- CVE-2026-105869 — Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role (CVSS 9.2)
- CVE-2026-105942 — Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation (CVSS 7.7)
- CVE-2026-105938 — Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all (CVSS 2.3)
- CVE-2026-105937 — Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data (CVSS 8.7)
- CVE-2026-105936 — Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint (CVSS 5.3)
- CVE-2026-105935 — Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission (CVSS 4.9)
- CVE-2026-105934 — Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic (CVSS 7.2)
- CVE-2026-105933 — Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization (CVSS 2.3)
- CVE-2026-105932 — Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints (CVSS 2.3)
- CVE-2026-105931 — Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants (CVSS 2.3)
- CVE-2026-105930 — Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download (CVSS 6.0)
- CVE-2025-30677 — Apache Pulsar IO Kafka Connector, Apache Pulsar IO Kafka Connect Adaptor: Sensitive information logged in Pulsar's Apache Kafka Connectors (CVSS 6.5)
- CVE-2024-29834 — Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints (CVSS 6.4)
- CVE-2024-28098 — Apache Pulsar: Improper Authorization For Topic-Level Policy Management (CVSS 5.4)
- CVE-2024-27894 — Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying (CVSS 8.8)
- CVE-2024-27317 — Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification (CVSS 9.9)
- CVE-2024-27135 — Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution (CVSS 9.9)
- CVE-2022-34321 — Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint (CVSS 8.2)
- CVE-2023-51437 — Apache Pulsar: Timing attack in SASL token signature verification (CVSS 7.4)
- CVE-2023-37544 — Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS (CVSS 7.5)
- CVE-2023-37579 — Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials (CVSS 6.5)
- CVE-2023-31007 — Apache Pulsar: Broker does not always disconnect client when authentication data expires (CVSS 6.5)