Apache Pulsar contains a flaw where a failure during topic initialization causes the broker to disable the enforcement of the namespace policy that requires end‑to‑end message encryption. The broker logs a warning, removes the encryption requirement for that topic, and continues to load the topic as if the error had not occurred. The result is that any authenticated producer with publish permission can send unencrypted messages that the broker accepts and stores, while encrypted messages remain protected. Because the broker does not expose the content of encrypted messages or the encryption keys, the vulnerability does not leak data that was already encrypted, but it does undermine the confidentiality guarantees that administrators intended by enabling the policy.

The issue affects Apache Pulsar releases starting with 1.22.0‑incubating up to, but not including, 4.0.14 and 4.1.0 up to, but not including, 4.2.5. Users on the 4.0.x series should upgrade to 4.0.14 or later, and users on the 4.1.x and 4.2.x series should upgrade to at least 4.2.5. The current supported release lines are 4.0.x and 5.0.x, which contain the fix.

The CVSS score is 2.3, indicating low overall severity. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires an authenticated client with produce permissions on a topic that has had an initialization failure that disabled encryption enforcement. The attacker would then publish unencrypted data. While the flaw does not expose encrypted content, it allows planned or opportunistic disclosure of data that otherwise would be protected, presenting a modest confidentiality risk. Because the problem is tied to initialization failures or metadata store errors, exploitation is likely limited to specific operational conditions and is not trivially immediate.