CVE-2026-105930

In Apache Pulsar , an improper authorization flaw allows an authenticated user to perform a cross-tenant package download. When package management is enabled, the Pulsar Functions worker fails to verify if a requesting user has permissions to access a package URL from a different namespace. Inste...