CVE-2026-105937 Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data

Apache Pulsar shadow topics PIP-180 are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting the reserved topic property PULSAR.SHADOWSOURCE. The admin REST API accepts this property when creating a non-partitioned or...