CVE-2026-105926

Name of the Vulnerable Software and Affected Versions Apache Pulsar versions 2.2.0 through 4.0.13 Apache Pulsar versions 4.1.0 through 4.1.3 Apache Pulsar versions 4.2.0 through 4.2.4

Description The Pulsar broker fails to verify if an authenticated client is authorized for a target topic when processing two specific binary protocol commands: GetSchema() and GetOrCreateSchema(). While the broker checks for authentication, it skips the authorization check required for other topic commands. This allows an authenticated client without permissions for a specific topic, namespace, or tenant to read schema definitions, such as record field names and types, or register a new schema version on an existing topic. Registering an unauthorized schema version can lead to schema incompatibility errors for legitimate producers and consumers. This issue only affects deployments with authentication and authorization enabled and does not impact the REST API endpoints. A client implementing the binary protocol directly can bypass the authorized topic lookup performed by the standard Pulsar client.

Recommendations Upgrade Apache Pulsar versions 2.2.0 through 4.0.13 to version 4.0.14 or newer. Upgrade Apache Pulsar versions 4.1.0 through 4.1.3 to version 4.2.5 or newer. Upgrade Apache Pulsar versions 4.2.0 through 4.2.4 to version 4.2.5 or newer.