74 matches found
CVE-2026-105936
The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint /admin/v2/worker/connectors and the deprecated functions connectors endpoint /admin/v2/functions/connectors and...
CVE-2026-105930
When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying a package URL. The Pulsar Functions worker authorized these requests only against the namespace in which the component...
com.clever-cloud:biscuit-pulsar (>=4.0.0, <=4.0.1), org.apache.pulsar:pulsar-broker (>=4.2.0, <=4.2.4) +10 more potentially affected by CVE-2026-105942 via org.apache.pulsar:pulsar-broker-common (>=4.2.0, <=4.2.4)
org.apache.pulsar:pulsar-broker-common MAVEN version =4.2.0, =4.0.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.4 Source cves: CVE-2026-105942 Source advisory: MEND:CVE-2026-105942...
org.apache.pulsar:pulsar-broker (>=4.2.0, <=4.2.4), org.apache.pulsar:pulsar-broker-auth-athenz (>=4.2.0, <=4.2.4) +3 more potentially affected by CVE-2026-105936 via org.apache.pulsar:pulsar-functions-worker (>=4.2.0, <=4.2.4)
org.apache.pulsar:pulsar-functions-worker MAVEN version =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.4 Source cves: CVE-2026-105936 Source advisory: MEND:CVE-2026-105936...
EUVD-2026-107473
The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint /admin/v2/worker/connectors and the deprecated functions connectors endpoint /admin/v2/functions/connectors and...
CVE-2026-105936
The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint /admin/v2/worker/connectors and the deprecated functions connectors endpoint /admin/v2/functions/connectors and...
CVE-2026-105935 Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission
The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the function's configured input topics. The Functions Worker performs this publish with its own broker client, which authenticates with the Worker's configured...
org.apache.pulsar:pulsar-broker (>=4.2.0, <=4.2.4), org.apache.pulsar:pulsar-broker-auth-athenz (>=4.2.0, <=4.2.4) +3 more potentially affected by CVE-2026-105935 via org.apache.pulsar:pulsar-functions-worker (>=4.2.0, <=4.2.4)
org.apache.pulsar:pulsar-functions-worker MAVEN version =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.4 Source cves: CVE-2026-105935 Source advisory: MEND:CVE-2026-105935...
CVE-2026-105930
When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying a package URL. The Pulsar Functions worker authorized these requests only against the namespace in which the component...
org.apache.pulsar:pulsar-broker (>=4.2.0, <=4.2.4), org.apache.pulsar:pulsar-broker-auth-athenz (>=4.2.0, <=4.2.4) +3 more potentially affected by CVE-2026-105930 via org.apache.pulsar:pulsar-functions-worker (>=4.2.0, <=4.2.4)
org.apache.pulsar:pulsar-functions-worker MAVEN version =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.4 Source cves: CVE-2026-105930 Source advisory: MEND:CVE-2026-105930...
CVE-2026-105930 Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download
When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying a package URL. The Pulsar Functions worker authorized these requests only against the namespace in which the component...
CVE-2026-105930
In Apache Pulsar , an improper authorization flaw allows an authenticated user to perform a cross-tenant package download. When package management is enabled, the Pulsar Functions worker fails to verify if a requesting user has permissions to access a package URL from a different namespace. Inste...
EUVD-2026-107428
When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying a package URL. The Pulsar Functions worker authorized these requests only against the namespace in which the component...
CVE-2026-105930 Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download
When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying a package URL. The Pulsar Functions worker authorized these requests only against the namespace in which the component...
PT-2026-120756
The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint /admin/v2/worker/connectors and the deprecated functions connectors endpoint /admin/v2/functions/connectors and...
PT-2026-120726
When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying a package URL. The Pulsar Functions worker authorized these requests only against the namespace in which the component...
Apache Pulsar authorization issue vulnerability
Vulnerabilities related to authorization issues exist in Apache Pulsar versions from 2.8.0 up to and including 4.0.14, from 4.1.0 up to and including 4.1.3, and from 4.2.0 up to and including 4.2.5. This vulnerability arises because when package management is enabled, the Pulsar Functions worker...
com.ascentstream.pulsar:pulsar-bookkeeper-prometheus-metrics-provider (4.0.11.0), com.ascentstream.pulsar:pulsar-broker (4.0.11.0) +88 more potentially affected by CVE-2026-10050 via org.eclipse.jetty.ee8:jetty-ee8-security (>=12.1.0, <=12.1.9)
org.eclipse.jetty.ee8:jetty-ee8-security MAVEN version =12.1.0, =5.0.1, =5.0.3-beta and more Source cves: CVE-2026-10050 Source advisory: OSV:GHSA-2FVJ-HGJ9-J2GR...