EUVD-2026-107473

The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint /admin/v2/worker/connectors and the deprecated functions connectors endpoint /admin/v2/functions/connectors and...

CVE-2026-105936

The Apache Pulsar Functions worker REST API contains a missing authorization check in its deprecated functions connectors endpoints (/admin/v2/functions/connectors and /admin/v3/functions/connectors). While the worker connectors endpoint requires super-user access, the deprecated endpoints return...