Description
The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint (/admin/v2/worker/connectors) and the deprecated functions connectors endpoint (/admin/v2/functions/connectors and /admin/v3/functions/connectors). When authorization is enabled, the worker connectors endpoint requires super-user access. The functions connectors endpoint, served both by the functions worker and by a broker running the functions worker, returns the same catalog without this check.

As a result, when authentication and authorization are enabled, any authenticated client can read the connector catalog through the functions connectors endpoint, regardless of the permissions granted to its role and without super-user access. Unauthenticated requests are rejected unless anonymous access is configured with an anonymous user role.

The catalog contains the connector type definitions installed in the functions worker's connectors directory: the connector name, its description, and the source, sink and configuration class names. It does not contain configured source or sink instances, their configuration values or credentials, and an installed connector type does not indicate that a connector is configured or running. The impact is limited to disclosure of this metadata, which can include the names and descriptions of custom connectors installed by the operator. The issue does not allow modifying the catalog or managing connectors. Connector definitions that have a source or sink class are also returned by the built-in sources and sinks endpoints to authenticated clients.

In fixed versions, the functions connectors endpoint applies the same checks as the worker connectors endpoint, so that it requires super-user access when authorization is enabled. Clients that are not super-users can use the built-in sources and sinks endpoints to list the available connector types.

This issue affects Apache Pulsar versions from 2.4.1 before 4.0.14 and from 4.1.0 before 4.2.5.

- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.
Published: 2026-10-21
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information disclosure of connector metadata
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows any authenticated client to list Pulsar IO connector types through the functions connectors REST endpoints without needing super‑user privileges when authorization is enabled. The catalog returned contains only connector type definitions—names, descriptions, and class names—that are installed in the worker’s connectors directory. The data does not expose configuration values, credentials, or running instances, so the flaw does not grant direct modification or execution rights, but it does leak operator‑specific metadata that could aid future attacks.

Affected Systems

Apache Pulsar versions starting at 2.4.1 up to, but not including, 4.0.14, and from 4.1.0 up to, but not including, 4.2.5 are vulnerable. Users of these releases should upgrade to at least 4.0.14 for the 4.0.x line or to at least 4.2.5 for the 4.1.x/4.2.x lines. The current supported lines are 4.0.x and 5.0.x.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate impact. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an authenticated REST API call to /admin/v2/functions/connectors or /admin/v3/functions/connectors; any authenticated user without super‑user rights can retrieve the exposed metadata. While the flaw does not facilitate code execution or data alteration, the disclosed metadata may assist attackers in identifying custom connectors and planning more targeted exploits.

Generated by OpenCVE AI on October 22, 2026 at 01:53 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache Pulsar to a patched release (≥4.0.14 or ≥4.2.5) so that the functions connectors endpoint enforces super‑user checks.
  • If an upgrade cannot be performed immediately, restrict access to the functions connectors endpoints by configuring ACLs to allow only super‑user roles, or disable the endpoints in the broker configuration if practicable.
  • Monitor broker logs for requests to /admin/v2/functions/connectors and /admin/v3/functions/connectors and adjust security policies to prevent unauthorized discovery of connector catalogs.

Generated by OpenCVE AI on October 22, 2026 at 01:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache pulsar
Vendors & Products Apache
Apache pulsar

Wed, 21 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint (/admin/v2/worker/connectors) and the deprecated functions connectors endpoint (/admin/v2/functions/connectors and /admin/v3/functions/connectors). When authorization is enabled, the worker connectors endpoint requires super-user access. The functions connectors endpoint, served both by the functions worker and by a broker running the functions worker, returns the same catalog without this check. As a result, when authentication and authorization are enabled, any authenticated client can read the connector catalog through the functions connectors endpoint, regardless of the permissions granted to its role and without super-user access. Unauthenticated requests are rejected unless anonymous access is configured with an anonymous user role. The catalog contains the connector type definitions installed in the functions worker's connectors directory: the connector name, its description, and the source, sink and configuration class names. It does not contain configured source or sink instances, their configuration values or credentials, and an installed connector type does not indicate that a connector is configured or running. The impact is limited to disclosure of this metadata, which can include the names and descriptions of custom connectors installed by the operator. The issue does not allow modifying the catalog or managing connectors. Connector definitions that have a source or sink class are also returned by the built-in sources and sinks endpoints to authenticated clients. In fixed versions, the functions connectors endpoint applies the same checks as the worker connectors endpoint, so that it requires super-user access when authorization is enabled. Clients that are not super-users can use the built-in sources and sinks endpoints to list the available connector types. This issue affects Apache Pulsar versions from 2.4.1 before 4.0.14 and from 4.1.0 before 4.2.5. - 4.0.x version users should upgrade to at least 4.0.14. - 4.1.x and 4.2.x version users should upgrade to at least 4.2.5. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.
Title Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Apache Pulsar
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-23T21:59:10.187Z

Reserved: 2026-10-06T06:44:47.654Z

Link: CVE-2026-105936

cve-icon Vulnrichment

Updated: 2026-10-23T20:42:37.783Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T19:16:56.540

Modified: 2026-10-23T22:16:52.147

Link: CVE-2026-105936

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T14:57:03Z

Weaknesses