Skip to main content

Security

Security Policy​

The Pulsar community follows the ASF security vulnerability handling process.

To report a new vulnerability you have discovered, please follow the ASF security vulnerability reporting process. To report a vulnerability for Pulsar, contact the Apache Security Team. When reporting a vulnerability to security@apache.org, you can copy your email to private@pulsar.apache.org to send your report to the Apache Pulsar Project Management Committee. This is a private mailing list.

It is the responsibility of the security vulnerability handling project team (Apache Pulsar PMC in most cases) to make public security vulnerability announcements. You can follow announcements on the users@pulsar.apache.org mailing list. For instructions on how to subscribe, please see https://pulsar.apache.org/contact/.

Security advisories​

Please subscribe to the users@pulsar.apache.org mailing list to receive Apache Pulsar security advisories when they are published. For instructions on how to subscribe, please see https://pulsar.apache.org/contact/.

2026​

  • 2026-10-21 CVE-2026-105869 Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role (🔴 severity: critical / 9.2)
  • 2026-10-21 CVE-2026-105944 Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life (🔴 severity: critical / 10.0)
  • 2026-10-21 CVE-2026-105934 Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic (🟠 severity: high / 7.2)
  • 2026-10-21 CVE-2026-105937 Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data (🟠 severity: high / 8.7)
  • 2026-10-21 CVE-2026-105942 Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation (🟠 severity: high / 7.7)
  • 2026-10-21 CVE-2026-105945 Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage (🟠 severity: high / 7.7)
  • 2026-10-21 CVE-2026-105926 Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands (🟡 severity: medium / 5.3)
  • 2026-10-21 CVE-2026-105930 Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download (🟡 severity: medium / 6.0)
  • 2026-10-21 CVE-2026-105935 Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission (🟡 severity: medium / 4.9)
  • 2026-10-21 CVE-2026-105936 Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint (🟡 severity: medium / 5.3)
  • 2026-10-21 CVE-2026-105927 Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission (🟢 severity: low / 2.3)
  • 2026-10-21 CVE-2026-105931 Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants (🟢 severity: low / 2.3)
  • 2026-10-21 CVE-2026-105932 Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints (🟢 severity: low / 2.3)
  • 2026-10-21 CVE-2026-105933 Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization (🟢 severity: low / 2.3)
  • 2026-10-21 CVE-2026-105938 Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all (🟢 severity: low / 2.3)

2025​

  • 2024-04-09 CVE-2025-30677 Apache Pulsar IO Kafka Connector, Apache Pulsar IO Kafka Connect Adaptor: Sensitive information logged in Pulsar's Apache Kafka Connectors

2024​

2023​

  • 2023-12-20 CVE-2023-37544 Improper Authentication for WebSocket Proxy Endpoint Allows DoS
  • 2023-07-13 CVE-2023-31007 Broker does not always disconnect client when authentication data expires
  • 2023-07-12 CVE-2023-30428 Incorrect Authorization Validation for Rest Producer
  • 2023-07-12 CVE-2023-30429 Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy
  • 2023-07-12 CVE-2023-37579 Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials

2022​

  • 2022-01-31 CVE-2021-41571 Pulsar Admin API allows access to data from other tenants using getMessageById API
  • 2022-09-22 CVE-2022-24280 Apache Pulsar Proxy target broker address isn't validated
  • 2022-09-22 CVE-2022-33681 Improper Hostname Verification in Java Client and Proxy can expose authentication data via MITM
  • 2022-09-22 CVE-2022-33682 Disabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attack
  • 2022-09-22 CVE-2022-33683 Disabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attack
  • 2022-11-03 CVE-2022-33684 Apache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate Validation

2021​

  • 2021-05-25 CVE-2021-22160 Authentication with JWT allows use of "none"-algorithm
Was this helpful?
💡 Suggest changes🛟 Get support