CVE-2026-105930

Name of the Vulnerable Software and Affected Versions Apache Pulsar versions 2.8.0 through 4.0.13 Apache Pulsar versions 4.1.0 through 4.1.3 Apache Pulsar versions 4.2.0 through 4.2.4

Description When package management is enabled via the enablePackagesManagement broker setting and the functionsWorkerEnablePackageManagement functions worker setting, the Pulsar Functions worker fails to properly validate if a requesting user has permission to access packages in the namespace referenced by a package URL. Instead of checking the user's permissions, the worker retrieves the package using its own credentials. This allows an authenticated user with permissions to register or update functions, sources, or sinks in their own tenant to access the contents of packages in namespaces belonging to other tenants. This can lead to the disclosure of sensitive information, such as application code, business logic, or embedded credentials.

Recommendations Upgrade Apache Pulsar versions 2.8.0 through 4.0.13 to version 4.0.14 or newer. Upgrade Apache Pulsar versions 4.1.0 through 4.1.3 to version 4.2.5 or newer. Upgrade Apache Pulsar versions 4.2.0 through 4.2.4 to version 4.2.5 or newer.