The vulnerability arises when the Pulsar broker processes the GetSchema and GetOrCreateSchema commands over the binary protocol after only authenticating the client. It does not verify that the authenticated client has the necessary topic permissions. An attacker who can connect to the broker can therefore read the schema layout of any topic, revealing field names and types, or register a new schema version on an unrelated topic. The payload data remains confidential, but the injected schema can trigger compatibility errors for legitimate producers and consumers, potentially leading to service interruption.

Apache Pulsar brokers in the Apache Software Foundation ecosystem are affected. Versions from 2.2.0 up to but excluding 4.0.14, from 4.1.0 through 4.1.3, and from 4.2.0 through 4.2.5 are vulnerable. The supported release lines 4.0.x and 5.0.x include the patched updates; users should upgrade to at least 4.0.14 on the 4.0.x line, and to at least 4.2.5 on both the 4.1.x and 4.2.x lines to remove the flaw.

The vulnerability carries a CVSS score of 5.3, indicating moderate overall severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog, suggesting limited known exploitation. However, the flaw can be exploited over an authenticated network connection without any extra privileges, and the missing authorization check lowers the barrier to attack. Adopting the default authorization provider provides the necessary fixes, but the risk remains if custom providers are used without the same checks.