Apache Pulsar's MultiRolesTokenAuthorizationProvider was designed to authorize clients based on roles contained in a signed JSON Web Token after authentication. In the affected versions, the provider parsed the token without verifying its signature, trusting that authentication had already validated it. When the broker configuration enabled an anonymousUserRole, HTTP or WebSocket requests that lacked valid credentials could fall back to that role. The provider then extracted the bearer token from the request header, accepted its unsigned or forged contents, and granted the roles listed in the token. This allowed an unauthenticated client to obtain any role, including super-user roles, and perform privileged operations such as reading or modifying tenants, namespaces, topics, permissions, and broker configuration.

This vulnerability affects Apache Pulsar deployments running versions 2.8.1 through before 4.0.14 and 4.1.0 through before 4.2.5. Systems using the Apache Software Foundation's Pulsar product that have enabled a non‑empty anonymousUserRole and allow the described fallback path are impacted. Deployments that use the default PulsarAuthorizationProvider, do not enable anonymousUserRole, or rely on binary protocol connections are not affected.

The CVSS base score is 9.2, indicating critical severity. The EPSS score is not available, so current exploitation likelihood is unknown, but the vulnerability is not listed in CISA's KEV catalog. Because the vulnerability can be triggered with any forged HTTP or WebSocket request and requires no valid credentials, the attack surface is high. An attacker can gain super‑user access on the broker, with a reasonable expectation of exploitation in a poorly secured environment.