Description
The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names consist of a type, tenant, namespace, name and version. Authorization of package operations is based only on the tenant and namespace, while the storage location of a package is derived from all of these components. The version component of a package name was not validated, so it could contain URL-encoded path separators and parent directory references. The filesystem storage provider resolved such a version to a location belonging to a package in a different tenant or namespace. Because that location is inside the configured storage directory, the containment check that the filesystem storage provider performs in recent releases did not prevent the access.

An authenticated user who has the packages permission on any namespace could use this to download, overwrite or delete packages stored in other tenants or namespaces for which the user has no permission. Packages overwritten or deleted in this way may be used by Pulsar Functions, Sources or Sinks, so the issue can affect the integrity and availability of these components. If authentication is disabled, the operations are available to any client that can reach the broker's admin REST API.

This issue only affects deployments in which package management is enabled with the broker setting enablePackagesManagement and the filesystem storage provider (FileSystemPackagesStorageProvider) is configured with the setting packagesManagementStorageProvider. Package management is disabled by default, and the default storage provider, which stores packages in Apache BookKeeper, is not affected.

This issue affects Apache Pulsar versions from 2.10.0 before 4.0.14 and from 4.1.0 before 4.2.5.

- 4.0.x version users should upgrade to at least 4.0.14.
- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.
Published: 2026-10-21
Score: 7.7 High
EPSS: n/a
KEV: No
Impact: Integrity compromise of Pulsar packages and availability of Functions, Sources or Sinks
Action: Immediate Patch
AI Analysis

Impact

This is a CWE-22 directory traversal vulnerability that arises when the Pulsar Packages Management Service uses a filesystem storage provider. Package names have type, tenant, namespace, name, and version. Validation only covers tenant and namespace; the version can contain URL‑encoded path separators and parent directory references, which the provider resolves to a location that may belong to a different tenant or namespace. Because the storage directory is within the configured path, the containment check fails. An authenticated user with packages permission on any namespace can download, overwrite, or delete packages belonging to tenants or namespaces for which they have no permission, enabling integrity and availability attacks on Pulsar Functions, Sources or Sinks. If authentication is disabled, the operations are available to any client that can reach the broker's admin REST API.

Affected Systems

The affected product is Apache Pulsar, specifically deployments where package management is enabled (enablePackagesManagement set to true) and the filesystem storage provider (FileSystemPackagesStorageProvider) is configured as packagesManagementStorageProvider. The vulnerability exists in versions from 2.10.0 until before 4.0.14 and from 4.1.0 until before 4.2.5. Users of the 4.0.x line should upgrade to at least 4.0.14, and users of the 4.1.x and 4.2.x lines should upgrade to at least 4.2.5. The supported release lines are 4.0.x and 5.0.x, and the community recommends upgrading to the latest supported release whenever possible.

Risk and Exploitability

The CVSS score is 7.7, indicating a high severity impact. The EPSS score is not available, and CISA has not listed this vulnerability in its KEV catalog. Attackers must be able to authenticate to the broker's admin REST API or have the broker running without authentication; the user must possess packages permissions on at least one namespace. Successful exploitation leads to unauthorized access to packages of other tenants or namespaces, which can compromise the integrity of Pulsar Functions and potentially cause denial of service if critical packages are deleted or tampered with.

Generated by OpenCVE AI on October 22, 2026 at 01:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Apache Pulsar 4.0.14, 4.2.5, or a newer supported release that contains the patch for this issue.
  • If an upgrade cannot be performed immediately, reconfigure the broker to use the default BookKeeper storage provider instead of the filesystem provider for package management.
  • Review restrict package permissions for all namespaces, ensuring that only trusted users have packages management rights, and disable enablePackagesManagement if it is not required for your deployment.

Generated by OpenCVE AI on October 22, 2026 at 01:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Description The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names consist of a type, tenant, namespace, name and version. Authorization of package operations is based only on the tenant and namespace, while the storage location of a package is derived from all of these components. The version component of a package name was not validated, so it could contain URL-encoded path separators and parent directory references. The filesystem storage provider resolved such a version to a location belonging to a package in a different tenant or namespace. Because that location is inside the configured storage directory, the containment check that the filesystem storage provider performs in recent releases did not prevent the access. An authenticated user who has the packages permission on any namespace could use this to download, overwrite or delete packages stored in other tenants or namespaces for which the user has no permission. Packages overwritten or deleted in this way may be used by Pulsar Functions, Sources or Sinks, so the issue can affect the integrity and availability of these components. If authentication is disabled, the operations are available to any client that can reach the broker's admin REST API. This issue only affects deployments in which package management is enabled with the broker setting enablePackagesManagement and the filesystem storage provider (FileSystemPackagesStorageProvider) is configured with the setting packagesManagementStorageProvider. Package management is disabled by default, and the default storage provider, which stores packages in Apache BookKeeper, is not affected. This issue affects Apache Pulsar versions from 2.10.0 before 4.0.14 and from 4.1.0 before 4.2.5. - 4.0.x version users should upgrade to at least 4.0.14. - 4.1.x and 4.2.x version users should upgrade to at least 4.2.5. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.
Title Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage
Weaknesses CWE-22
References
Metrics cvssV4_0

{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-21T18:18:26.687Z

Reserved: 2026-10-06T07:19:45.804Z

Link: CVE-2026-105945

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-21T19:16:57.660

Modified: 2026-10-21T19:16:57.660

Link: CVE-2026-105945

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T02:00:10Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')