CVE-2026-105944

Name of the Vulnerable Software and Affected Versions Apache Pulsar Manager versions 0.1.0 through 0.4.0

Description Apache Pulsar Manager contains several security flaws. The process for creating the initial administrator account is accessible without authentication and remains available after initialization, allowing any network-reachable user to create an administrator account. In versions 0.3.0 and later, the software does not distinguish between privilege levels, granting all accounts full administrative rights. Additionally, requests proxied to the Pulsar admin API bypass authentication, enabling unauthenticated users to perform administrative operations using the configured credentials. Furthermore, a requester can specify the destination of a proxied request, causing Pulsar Manager to send its configured admin credentials to an arbitrary host. If configured with a token signing key, a Pulsar Manager administrator can generate tokens for the cluster.

Recommendations Stop using Apache Pulsar Manager and remove all existing deployments. Replace any Pulsar credentials or token signing keys that were used in Pulsar Manager configurations. Restrict network access to trusted administrators and do not expose the software to untrusted networks until it is removed.