CVE-2026-105936

The Apache Pulsar Functions worker REST API contains a missing authorization check in its deprecated functions connectors endpoints (/admin/v2/functions/connectors and /admin/v3/functions/connectors). While the worker connectors endpoint requires super-user access, the deprecated endpoints return...