Description
The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate). Truncating a topic moves all subscription cursors of the topic to the end of the topic and deletes the topic's inactive ledgers. Truncating a non-partitioned topic, or a single partition addressed by its partition name, correctly requires the tenant admin role or the superuser role. When the operation is requested for the name of a partitioned topic, the broker does not apply this tenant admin check to the caller. Instead, it truncates each partition using the broker's own internal admin client, which authenticates with the broker's configured client credentials rather than the caller's identity. Each per-partition truncate request is still checked for the tenant admin role or the superuser role, but against the broker's internal identity instead of the caller. The partitions are therefore truncated only when the broker's configured client role is a superuser or an admin of the target tenant, which is the usual configuration when authorization is enabled.

As a result, when that condition holds, an authenticated user who is not a tenant admin can truncate any partitioned topic on which the user has lookup permission. Caller authentication and lookup permission alone are not sufficient: if the broker's internal identity lacks tenant admin or superuser authorization for the target tenant, the per-partition requests are rejected. With the default authorization provider, lookup permission is granted by produce or consume permission on the topic or its namespace. A user with no permissions on the topic cannot trigger the issue. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be different.

Truncating a partitioned topic this way moves the cursors of all subscriptions on every partition to the end of the topic, so any unacknowledged backlog is skipped and is no longer delivered to consumers. It also deletes eligible older ledgers of each partition regardless of the namespace's configured retention policy, so messages stored in those ledgers can be permanently lost. The ledger currently being written is not deleted by the truncate operation. The issue does not allow reading message contents or changing permissions or configuration, and it does not give access to topics on which the user has no lookup permission.

This issue affects Apache Pulsar versions from 2.8.0 before 4.0.14 and from 4.1.0 before 4.2.5.

- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.

Users who cannot upgrade immediately can reduce exposure by restricting network access to the broker's admin REST API (/admin/v2) to trusted administrative clients.
Published: 2026-10-21
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data loss
Action: Immediate Patch
AI Analysis

Impact

The Apache Pulsar broker admin REST API contains a truncate operation for persistent topics. When truncating a partitioned topic, the broker bypasses the tenant admin authorization check for the caller and instead performs each per‑partition truncate using the broker’s internal admin client. If the broker’s internal credentials hold tenant admin or superuser authority—commonly the case in default deployments, a user who only has lookup permission (derived from produce or consume rights) can trigger the truncate for the entire partitioned topic. This moves all subscription cursors to the end of each partition, discarding any unacknowledged backlog, and removes older ledgers regardless of retention policies, resulting in permanent loss of messages. The operation does not expose message contents or alter permissions, but it erases data that would otherwise be recoverable.

Affected Systems

Apache Pulsar, versions 2.8.0 up to but not including 4.0.14, and 4.1.0 up to but not including 4.2.5. The currently supported release lines are 4.0.x and 5.0.x; users on earlier releases should upgrade to 4.0.14 or 4.2.5+ to apply the fix.

Risk and Exploitability

The vulnerability is rated CVSS 7.2, with no EPSS data currently available and no listing in the CISA KEV catalog. The likely attack vector is an authenticated user performing a REST API call to DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate. The attacker must possess lookup rights on the target topic, which typically implies produce or consume permissions. If the broker’s internal identity is configured as tenant admin or superuser, the truncate proceeds successfully. Thus, the risk level is moderate to high for deployments with default authorization settings, offering a path to significant data loss without requiring elevated user privileges.

Generated by OpenCVE AI on October 22, 2026 at 01:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Pulsar to at least 4.0.14 if on a 4.0.x line or 4.2.5 if on a 4.1.x/4.2.x line; later releases contain the fix.
  • If immediate upgrade is not feasible, restrict network access to the broker’s admin REST API (/admin/v2) to trusted administrative clients only.
  • Verify that the broker’s internal client credentials do not hold tenant admin or superuser rights—limit them to the minimal privileges required for broker operation.
  • Ensure users do not have lookup permission on topics they should not affect, enforcing least‑privilege ownership of namespaces and topics.

Generated by OpenCVE AI on October 22, 2026 at 01:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache pulsar
Vendors & Products Apache
Apache pulsar

Wed, 21 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace}/{topic}/truncate). Truncating a topic moves all subscription cursors of the topic to the end of the topic and deletes the topic's inactive ledgers. Truncating a non-partitioned topic, or a single partition addressed by its partition name, correctly requires the tenant admin role or the superuser role. When the operation is requested for the name of a partitioned topic, the broker does not apply this tenant admin check to the caller. Instead, it truncates each partition using the broker's own internal admin client, which authenticates with the broker's configured client credentials rather than the caller's identity. Each per-partition truncate request is still checked for the tenant admin role or the superuser role, but against the broker's internal identity instead of the caller. The partitions are therefore truncated only when the broker's configured client role is a superuser or an admin of the target tenant, which is the usual configuration when authorization is enabled. As a result, when that condition holds, an authenticated user who is not a tenant admin can truncate any partitioned topic on which the user has lookup permission. Caller authentication and lookup permission alone are not sufficient: if the broker's internal identity lacks tenant admin or superuser authorization for the target tenant, the per-partition requests are rejected. With the default authorization provider, lookup permission is granted by produce or consume permission on the topic or its namespace. A user with no permissions on the topic cannot trigger the issue. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be different. Truncating a partitioned topic this way moves the cursors of all subscriptions on every partition to the end of the topic, so any unacknowledged backlog is skipped and is no longer delivered to consumers. It also deletes eligible older ledgers of each partition regardless of the namespace's configured retention policy, so messages stored in those ledgers can be permanently lost. The ledger currently being written is not deleted by the truncate operation. The issue does not allow reading message contents or changing permissions or configuration, and it does not give access to topics on which the user has no lookup permission. This issue affects Apache Pulsar versions from 2.8.0 before 4.0.14 and from 4.1.0 before 4.2.5. - 4.0.x version users should upgrade to at least 4.0.14. - 4.1.x and 4.2.x version users should upgrade to at least 4.2.5. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/. Users who cannot upgrade immediately can reduce exposure by restricting network access to the broker's admin REST API (/admin/v2) to trusted administrative clients.
Title Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Apache Pulsar
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-23T22:00:04.202Z

Reserved: 2026-10-06T06:42:50.881Z

Link: CVE-2026-105934

cve-icon Vulnrichment

Updated: 2026-10-23T20:42:30.864Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T19:16:56.103

Modified: 2026-10-23T22:16:51.803

Link: CVE-2026-105934

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T22:00:14Z

Weaknesses