The vulnerability enables an authenticated consumer to configure a dead‑letter topic via WebSocket query parameters. When authorization is on, the service verifies only the consumer role has CONSUME rights on the source topic, but it does not verify the producer rights on the dead‑letter topic. Consequently the broker client that the WebSocket service uses can publish messages to any topic in any namespace for which that client is authorized to produce, regardless of the consuming role. The injected messages carry standard dead‑letter properties and are therefore distinguishable from normal traffic, but their contents are fully controlled by the malicious consumer. The impact is the injection of untrusted data into topics a user normally cannot write to, potentially disrupting downstream consumers or consuming storage and backlog capacity.

Apache Pulsar versions 2.3.0 through 4.0.13 and 4.1.0 through 4.2.4 are vulnerable. Users on the stable 4.0.x line should upgrade to at least 4.0.14, while those on 4.1.x or 4.2.x should move to at least 4.2.5. All other Pulsar releases after these thresholds are considered patched.

The CVSS score of 2.3 indicates low overall severity; the EPSS score is currently unknown and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the WebSocket service to be enabled (either in broker or as a proxy), an authenticated consumer with consume rights to any topic, and that the broker client role used by the service has produce rights on a target namespace. If the target topic already exists, the injected producer is silently rejected when the topic requires a schema; therefore the attack is more effective in environments without schema enforcement. In practice the risk is limited to the potential injection of arbitrary data, but repeated injection can deplete storage or backlog quotas. Given these constraints, the risk is considered low to moderate, warranting timely remediation rather than immediate emergency response.