CVE-2026-105927

Name of the Vulnerable Software and Affected Versions Apache Pulsar versions 2.3.0 through 4.0.13 Apache Pulsar versions 4.1.0 through 4.2.4

Description The Apache Pulsar WebSocket service fails to verify if a connecting user has the necessary PRODUCE permissions for the topic specified in the deadLetterTopic query parameter of the consumer endpoint. While the service checks for CONSUME permissions on the subscribed topic, it writes dead letter messages using its own broker client identity instead of the user's identity. This allows an authenticated user with CONSUME permissions on any topic to inject messages into an arbitrary topic within any existing namespace, including those of other tenants, provided the WebSocket service role has the required permissions and the target topic does not enforce schema validation. This issue is only present when the WebSocket service is enabled via the webSocketServiceEnabled setting in the broker or used as a standalone WebSocket proxy. The impact is the unauthorized injection of messages, which can consume storage and backlog capacity in the target namespace.

Recommendations Upgrade Apache Pulsar versions 2.3.0 through 4.0.13 to version 4.0.14 or newer. Upgrade Apache Pulsar versions 4.1.0 through 4.2.4 to version 4.2.5 or newer. Disable the WebSocket service if it is not required. Restrict network access to the WebSocket service. Limit the permissions of the role used by the WebSocket service to only the namespaces that WebSocket clients are intended to access.