Description
Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the following security issues:

- The operation for creating the initial administrator (superuser) account is available without authentication, and it remains available after the instance has been initialized. Anyone who can reach Pulsar Manager can create an additional administrator account at any time and log in with it. This issue affects versions 0.3.0 and later.
- Requests to the Pulsar admin API that Pulsar Manager proxies to the configured Pulsar cluster are not subject to Pulsar Manager's authentication. Version 0.2.0 checks the caller's permissions for some of these requests, but not for all of them. An unauthenticated user can therefore use Pulsar Manager to send requests to the Pulsar admin API, which the cluster processes with the credential configured in Pulsar Manager.
- The destination of a proxied request can be chosen by the requester, and Pulsar Manager attaches its configured Pulsar admin credential to the request. An unauthenticated user can make Pulsar Manager send this credential to a host of the user's choosing, and the credential can then be used directly against the Pulsar cluster.
- In versions 0.3.0 and later, Pulsar Manager does not distinguish between privilege levels of its accounts. Every account, including one created through the first issue, effectively has full administrative privileges in Pulsar Manager.

The impact depends on the version and the deployment. In versions 0.3.0 and later, any user who can reach Pulsar Manager over the network can take full control of Pulsar Manager. In all versions, when Pulsar Manager is configured with an HTTP authentication credential for a Pulsar cluster, any user who can reach Pulsar Manager can perform the Pulsar admin operations that this credential permits and can obtain the credential itself. When Pulsar Manager is configured with the token signing key of a Pulsar cluster, an administrator of Pulsar Manager can create tokens for the cluster.

Apache Pulsar Manager is no longer maintained and is completely unsupported. The Apache Pulsar PMC has retired it. There are no supported versions, and no further releases, fixes or security updates will be made for any version. These issues will not be fixed.

Using Pulsar Manager is not recommended. Users should stop using Pulsar Manager, remove existing deployments, and move to one of the alternatives described in the Administration UI documentation (https://pulsar.apache.org/docs/administration-ui). Users who have exposed Pulsar Manager configured with a Pulsar credential or token signing key should also consider replacing that credential or key.

Until a deployment is removed, users should not expose Pulsar Manager to untrusted networks, and should restrict network access to it to trusted administrators.
Published: 2026-10-21
Score: 10 Critical
EPSS: n/a
KEV: No
Impact: Privilege Escalation
Action: Immediate Discontinue
AI Analysis

Impact

Apache Pulsar Manager contains missing authentication and authorization controls that allow any network participant to create additional administrator accounts, proxy Pulsar admin API requests, and obtain privileged credentials. The lack of authentication is classified under CWE-306. As a result, an attacker can obtain full administrative control of Pulsar Manager and, if the system is configured with a Pulsar cluster credential, can also perform administrative operations on the underlying Pulsar cluster and capture the credential itself.

Affected Systems

The vulnerability affects Apache Pulsar Manager, particularly versions 0.2.0 and 0.3.0 and later. The product is in end‑of‑life status and is no longer maintained or supported by the Apache Pulsar PMC. All deployments of these versions are impacted regardless of the security configuration chosen.

Risk and Exploitability

The CVSS score of 10 reflects the extreme severity of this flaw, while the EPSS score is not available, suggesting that official data on current exploitation probability is lacking. Although the vulnerability is not listed in the CISA KEV catalog, the absence of authentication combined with the ability to create administrators or forward privileged credentials to arbitrary hosts implies a high likelihood of exploitation by an attacker who can reach Pulsar Manager over the network. The impact could compromise both the management console and the underlying Pulsar cluster, giving attackers unrestricted control and data access.

Generated by OpenCVE AI on October 21, 2026 at 22:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Stop using Apache Pulsar Manager immediately and migrate to an actively supported Pulsar administration solution.
  • Remove all existing Pulsar Manager deployments and ensure the services are shut down or isolated from untrusted networks.
  • Replace any Pulsar cluster credentials or token signing keys that were exposed through an unsecured Pulsar Manager instance.
  • If Pulsar Manager must remain in operation, restrict network access so that only trusted administrators can reach it, preferably through a secure VPN or firewall rules.
  • Regularly review and update the credentials or tokens used by Pulsar Manager to minimize the window of exposure if the system cannot be removed quickly.

Generated by OpenCVE AI on October 21, 2026 at 22:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
References

Wed, 21 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the following security issues: - The operation for creating the initial administrator (superuser) account is available without authentication, and it remains available after the instance has been initialized. Anyone who can reach Pulsar Manager can create an additional administrator account at any time and log in with it. This issue affects versions 0.3.0 and later. - Requests to the Pulsar admin API that Pulsar Manager proxies to the configured Pulsar cluster are not subject to Pulsar Manager's authentication. Version 0.2.0 checks the caller's permissions for some of these requests, but not for all of them. An unauthenticated user can therefore use Pulsar Manager to send requests to the Pulsar admin API, which the cluster processes with the credential configured in Pulsar Manager. - The destination of a proxied request can be chosen by the requester, and Pulsar Manager attaches its configured Pulsar admin credential to the request. An unauthenticated user can make Pulsar Manager send this credential to a host of the user's choosing, and the credential can then be used directly against the Pulsar cluster. - In versions 0.3.0 and later, Pulsar Manager does not distinguish between privilege levels of its accounts. Every account, including one created through the first issue, effectively has full administrative privileges in Pulsar Manager. The impact depends on the version and the deployment. In versions 0.3.0 and later, any user who can reach Pulsar Manager over the network can take full control of Pulsar Manager. In all versions, when Pulsar Manager is configured with an HTTP authentication credential for a Pulsar cluster, any user who can reach Pulsar Manager can perform the Pulsar admin operations that this credential permits and can obtain the credential itself. When Pulsar Manager is configured with the token signing key of a Pulsar cluster, an administrator of Pulsar Manager can create tokens for the cluster. Apache Pulsar Manager is no longer maintained and is completely unsupported. The Apache Pulsar PMC has retired it. There are no supported versions, and no further releases, fixes or security updates will be made for any version. These issues will not be fixed. Using Pulsar Manager is not recommended. Users should stop using Pulsar Manager, remove existing deployments, and move to one of the alternatives described in the Administration UI documentation (https://pulsar.apache.org/docs/administration-ui). Users who have exposed Pulsar Manager configured with a Pulsar credential or token signing key should also consider replacing that credential or key. Until a deployment is removed, users should not expose Pulsar Manager to untrusted networks, and should restrict network access to it to trusted administrators.
Title Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life
Weaknesses CWE-306
References
Metrics cvssV4_0

{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-21T22:07:22.765Z

Reserved: 2026-10-06T07:06:42.319Z

Link: CVE-2026-105944

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-21T19:16:57.437

Modified: 2026-10-21T22:16:46.550

Link: CVE-2026-105944

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T22:30:07Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function