# CVE-2026-105926: Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands - **Severity:** Medium 5.3 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:L`) - **Exploited in the wild:** Not known - **Fix available:** Yes - **Published:** 21 Oct 2026 - **Updated:** 21 Oct 2026 - **Also known as:** GHSA-7rwq-965f-3p4j, MINI-8m5p-hg7m-2gcm, MINI-f8wr-mpfj-47vg, MINI-gr4j-9748-wcp3, MINI-mmxh-cv4w-h632 ## What is CVE-2026-105926? CVE-2026-105926 is a medium-severity vulnerability in Apache Pulsar, published on 21 Oct 2026. ### Official description The Pulsar broker serves two schema commands on its binary protocol: GetSchema, which returns the schema registered for a topic, and GetOrCreateSchema, which registers a new schema version for an existing topic. The broker handled both commands after checking only that the client connection was authenticated. Unlike the broker's other topic commands, such as those for creating producers and consumers or for looking up topics, these two commands did not check whether the authenticated client was authorized for the target topic. The Pulsar REST API endpoints for schemas were not affected. An authenticated client without any permission on the target topic, namespace or tenant could use these commands to: - read the schema registered for a topic in another namespace or tenant, disclosing the schema definition such as record field names and types. Message payloads are not disclosed. - register a new schema version on an existing topic in another namespace or tenant. The topic's schema compatibility and schema auto-update policies still apply. The issue does not allow message data to be read or modified, but a registered schema version can cause legitimate producers and consumers of that topic to fail with schema incompatibility errors until the schema is corrected by an administrator. The standard Pulsar client performs an authorized topic lookup before it sends these commands, so the missing check could not be observed when testing with the standard client. A client that implements the binary protocol directly is not required to perform that lookup first. This issue is relevant only to deployments that have authentication and authorization enabled. The GetSchema command is affected from Apache Pulsar 2.2.0, and the GetOrCreateSchema command from Apache Pulsar 2.5.0. After the fix, the broker requires the lookup permission on the topic for GetSchema and the produce permission on the topic for GetOrCreateSchema. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be slightly different. This issue affects Apache Pulsar versions from 2.2.0 before 4.0.14, from 4.1.0 through 4.1.3, and from 4.2.0 before 4.2.5. - 4.0.x version users should upgrade to at least 4.0.14. - 4.1.x and 4.2.x version users should upgrade to at least 4.2.5. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/. Weakness: CWE-862 (Missing Authorization) ## Which versions are affected by CVE-2026-105926? ## How do I fix CVE-2026-105926? Upgrade to a fixed version. ## Is CVE-2026-105926 being exploited? There is no known exploitation of CVE-2026-105926 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-105926 and fix it if it is affected. What it is: CVE-2026-105926 is a medium-severity vulnerability in Apache Pulsar, published on 21 Oct 2026. Exploitation: There is no known exploitation of CVE-2026-105926 in the wild and no public exploit code. Affected product: Apache Pulsar. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-105926/ (Markdown: https://insights.sbomify.com/CVE-2026-105926/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-105926 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105926 - OSV: https://osv.dev/vulnerability/CVE-2026-105926 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-105926/ Summaries are generated and may contain mistakes; the official description above is the record.