Description
When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying a package URL. The Pulsar Functions worker authorized these requests only against the namespace in which the component was being registered or updated. It did not check whether the requesting user was permitted to access packages in the namespace that the package URL refers to, and it retrieved the package from the broker using the worker's own credentials. The permission check of the Packages Management Service was therefore applied to the worker's identity instead of the requesting user's. Package URLs of transform functions supplied when registering or updating a sink were handled in the same way.

An authenticated user who is permitted to register or update functions, sources or sinks in any namespace of their own tenant could use this to obtain the contents of a package stored in a namespace of another tenant, without having the packages permission on that namespace. The impact is limited to disclosure of package contents, which may include application code, business logic or embedded credentials. The issue does not allow packages to be modified or deleted and does not affect availability.

This issue only affects deployments that have authentication and authorization enabled and in which package management has been enabled: the broker setting enablePackagesManagement and, in current releases, the functions worker setting functionsWorkerEnablePackageManagement. Both settings are disabled by default.

This issue affects Apache Pulsar versions from 2.8.0 before 4.0.14, from 4.1.0 through 4.1.3, and from 4.2.0 before 4.2.5.

- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.
Published: 2026-10-21
Score: 6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure via Cross‑Tenant Package Download
Action: Immediate Patch
AI Analysis

Impact

Apache Pulsar functions, sources, and sinks can be registered or updated by providing a package URL. The worker only checks permissions on its own namespace, not the URL's target namespace, and pulls the package with its credentials. This allows an authenticated user who can register or update components in their own tenant to download the contents of a package stored in another tenant's namespace, exposing code or credentials. The flaw does not permit modifying or deleting packages and does not affect system availability.

Affected Systems

The vulnerability impacts Apache Pulsar versions 2.8.0 through 4.0.13, 4.1.0 through 4.1.3, and 4.2.0 through 4.2.4 when authentication, authorization, and package management are enabled. Vendors are advised to upgrade to at least 4.0.14, 4.2.5, or newer supported releases such as 5.0.x.

Risk and Exploitability

The CVSS score is 6.0, indicating moderate severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog. The attacker must be authenticated with permission to register or update functions, sources, or sinks within their own tenant, but the vulnerability grants access to package contents from another tenant. Since the vulnerability relies on existing authorization mechanisms, its exploitation will be limited to environments where package management is enabled and authentication is enforced. The potential impact is the disclosure of application code, business logic, or embedded credentials.

Generated by OpenCVE AI on October 22, 2026 at 01:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Pulsar to a patched version such as 4.0.14, 4.2.5, or newer 5.0.x releases.
  • If upgrading immediately is impractical, disable package management by setting enablePackagesManagement and functionsWorkerEnablePackageManagement to false.
  • Review namespace permissions and restrict the ability to register or update functions, sources, or sinks to only trusted users or administrators, ensuring that cross‑tenant package URL access is prohibited.

Generated by OpenCVE AI on October 22, 2026 at 01:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache pulsar
Vendors & Products Apache
Apache pulsar

Wed, 21 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
Description When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying a package URL. The Pulsar Functions worker authorized these requests only against the namespace in which the component was being registered or updated. It did not check whether the requesting user was permitted to access packages in the namespace that the package URL refers to, and it retrieved the package from the broker using the worker's own credentials. The permission check of the Packages Management Service was therefore applied to the worker's identity instead of the requesting user's. Package URLs of transform functions supplied when registering or updating a sink were handled in the same way. An authenticated user who is permitted to register or update functions, sources or sinks in any namespace of their own tenant could use this to obtain the contents of a package stored in a namespace of another tenant, without having the packages permission on that namespace. The impact is limited to disclosure of package contents, which may include application code, business logic or embedded credentials. The issue does not allow packages to be modified or deleted and does not affect availability. This issue only affects deployments that have authentication and authorization enabled and in which package management has been enabled: the broker setting enablePackagesManagement and, in current releases, the functions worker setting functionsWorkerEnablePackageManagement. Both settings are disabled by default. This issue affects Apache Pulsar versions from 2.8.0 before 4.0.14, from 4.1.0 through 4.1.3, and from 4.2.0 before 4.2.5. - 4.0.x version users should upgrade to at least 4.0.14. - 4.1.x and 4.2.x version users should upgrade to at least 4.2.5. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.
Title Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download
Weaknesses CWE-863
References
Metrics cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Apache Pulsar
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-26T14:35:21.565Z

Reserved: 2026-10-06T06:34:21.894Z

Link: CVE-2026-105930

cve-icon Vulnrichment

Updated: 2026-10-26T14:32:27.207Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T18:17:23.010

Modified: 2026-10-26T15:16:34.793

Link: CVE-2026-105930

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T10:40:41Z

Weaknesses