The Apache Software Foundation has disclosed 17 security vulnerabilities affecting Apache Pulsar, Apache Pulsar Manager, Apache IoTDB, and the IoTDB JDBC driver. The vulnerabilities include authentication and authorization bypasses, improper token validation, cross-tenant data exposure, path traversal, and uncontrolled resource consumption. Successful exploitation could allow attackers to gain administrative privileges, access or delete sensitive messages and database records, manipulate packages, and compromise the confidentiality, integrity, and availability of affected systems.
- CVE-2026-105944 (CVSS 10.0 – Critical): Apache Pulsar Manager lacks adequate authentication and authorization controls, potentially allowing unauthenticated attackers to access administrative APIs and disclose configured Pulsar administrator credentials. The affected tool has been retired and will not receive a patch.[/subscribe_to_unlock_form]
The Apache Software Foundation has disclosed 17 security vulnerabilities affecting Apache Pulsar, Apache Pulsar Manager, Apache IoTDB, and the IoTDB JDBC driver. The vulnerabilities include authentication and authorization bypasses, improper token validation, cross-tenant data exposure, path traversal, and uncontrolled resource consumption. Successful exploitation could allow attackers to gain administrative privileges, access or delete sensitive messages and database records, manipulate packages, and compromise the confidentiality, integrity, and availability of affected systems.
- CVE-2026-105944 (CVSS 10.0 – Critical): Apache Pulsar Manager lacks adequate authentication and authorization controls, potentially allowing unauthenticated attackers to access administrative APIs and disclose configured Pulsar administrator credentials. The affected tool has been retired and will not receive a patch.[emaillocker id="1283"]
- CVE-2026-105869 (CVSS 9.2 – Critical): Improper validation of bearer-token signatures in Pulsar’s MultiRolesTokenAuthorizationProvider could allow attackers to submit forged tokens and obtain unauthorized administrative privileges when anonymous-user fallback is configured.
- CVE-2026-105937 (CVSS 8.7 – High): Missing authorization checks for shadow-topic source configuration could allow cross-tenant message disclosure and deletion of source-topic data.
- CVE-2026-105945 (CVSS 7.7 – High): Improper validation of package-version path components could enable cross-tenant package overwriting or deletion through path traversal.
- CVE-2026-105942 (CVSS 7.7 – High): Improper authorization of proxied requests could cause requests to be evaluated using the proxy’s privileges rather than the original user’s permissions, potentially enabling privilege escalation.
- CVE-2026-105934 (CVSS 7.2 – High): Missing tenant-administrator authorization checks when truncating partitioned topics could allow unauthorized users to delete topic backlogs.
- CVE-2026-105930 (CVSS 6.0 – Medium): Improper authorization of function, source, and sink package URLs could allow cross-tenant package downloads.
- CVE-2026-105936 (CVSS 5.3 – Medium): Missing superuser authorization checks on the function connector listing endpoint could expose connector information to unauthorized users.
- CVE-2026-59229: The Apache IoTDB Legacy Pipe receiver uses a hardcoded SUPER_USER identity, potentially allowing users with certain system-level privileges to load or delete database data with root-level permissions.
- CVE-2026-58663: An authentication bypass in Apache IoTDB’s Thrift RPC service could allow unauthorized access to the service.
- CVE-2026-59562: Missing authentication for a critical Apache IoTDB function could allow unauthorized operations.
- CVE-2026-41114: Uncontrolled resource consumption in the Apache IoTDB JDBC driver could affect application availability.
The supplied article also identifies additional Apache Pulsar vulnerabilities involving schema modification, unauthorized function execution, subscription policy bypasses, encryption enforcement failures, transaction metadata exposure, and WebSocket dead-letter topic writes. Individual CVSS scores for these additional issues are not provided in the supplied text.
The following reports contain further technical details:
[/emaillocker]