CVE-2026-105869

Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...

CVE-2026-105942 Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation

When a configured proxy role sends a request to the broker on behalf of another user the original principal, the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the original principal cannot exceed its ow...

CVE-2026-105942

This vulnerability affects Apache Pulsar versions from 2.8.1 before 4.0.14 and from 4.1.0 before 4.2.5. The issue stems from two flaws in how the broker authorizes proxied requests. First, the broker sometimes authorizes the original principal using the proxy's authentication data instead of its ...

CVE-2026-105942 Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation

When a configured proxy role sends a request to the broker on behalf of another user the original principal, the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the original principal cannot exceed its ow...

CVE-2026-105869 Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role

Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...

CVE-2026-105869 Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role

Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...

EUVD-2026-107422

Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...

CVE-2026-105869

Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token JWT. The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed t...

CVE-2026-105869

Apache Pulsar's MultiRolesTokenAuthorizationProvider contains a vulnerability where it fails to verify the signature of JSON Web Tokens (JWT) during authorization. When anonymousUserRole is set to a non-empty value and strictAuthMethod is false (default), requests with failed credentials may fall...

PT-2026-120723

Name of the Vulnerable Software and Affected Versions Apache Pulsar versions 2.8.1 through 4.0.13 Apache Pulsar versions 4.1.0 through 4.2.4 Description MultiRolesTokenAuthorizationProvider authorizes clients based on roles listed in a JSON Web Token JWT claim but fails to verify the token...

Apache Pulsar encryption issue vulnerability

Versions 2.8.1 through 4.0.14 and 4.1.0 through 4.2.5 of Apache Pulsar contain an encryption-related vulnerability. This flaw arises because MultiRolesTokenAuthorizationProvider fails to validate JWT signatures; instead, it relies on role claims within tokens for authorization. When...