# CVE-2026-105931: The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. - **Severity:** Low 2.3 (`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N`) - **Exploited in the wild:** Not known - **Fix available:** Yes - **Published:** 21 Oct 2026 - **Updated:** 21 Oct 2026 - **Also known as:** GHSA-jcv9-8hfx-9w7x, MINI-5c6f-cw9q-hfr4, MINI-f6w4-rx23-vvq3, MINI-q938-w664-rvq4, MINI-x75r-37qw-5q3w ## What is CVE-2026-105931? CVE-2026-105931 is a low-severity vulnerability in Apache Pulsar, published on 21 Oct 2026. ### Official description The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are enabled, most of the read endpoints of this API verify only that the request is authenticated and that the broker serves the requested topic or transaction coordinator. They do not check whether the caller is permitted to access the tenant, namespace or topic whose data is returned. The endpoints that modify state, which abort a transaction or scale the transaction coordinators, correctly require super-user access and are not affected. As a result, any authenticated user, including one that has been granted no permissions, can read transaction coordinator and transaction information belonging to other tenants. This includes the list of transaction coordinators with the broker service URLs that serve them, transaction coordinator statistics and internal statistics, transaction metadata including the names of the topics and subscriptions a transaction involves and the principal that opened it, the list of long-running transactions on a transaction coordinator, transaction buffer and pending acknowledgement statistics and internal statistics for any topic and subscription, and whether a given message position of a subscription is currently held in a pending transactional acknowledgement. The disclosure of transaction metadata and statistics can only occur when transaction support is enabled in the broker (transactionCoordinatorEnabled, which is disabled by default). When transaction support is disabled, these endpoints return no transaction data; the only residual effect is that one endpoint's error response can reveal whether a named topic exists in another tenant. The impact is limited to disclosure of transaction-related metadata and statistics across tenant boundaries. The issue does not allow reading message contents, modifying or aborting transactions, or changing any configuration. This issue affects Apache Pulsar versions from 2.8.0 before 4.0.14 and from 4.1.0 before 4.2.5. - 4.0.x version users should upgrade to at least 4.0.14. - 4.1.x and 4.2.x version users should upgrade to at least 4.2.5. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/. Users who cannot upgrade immediately and do not use Pulsar transactions should keep transaction support disabled. Where transactions are required, restricting network access to the broker's admin HTTP endpoints to trusted administrative clients reduces the exposure. Weakness: CWE-862 (Missing Authorization) ## Which versions are affected by CVE-2026-105931? ## How do I fix CVE-2026-105931? Upgrade to a fixed version. ## Is CVE-2026-105931 being exploited? There is no known exploitation of CVE-2026-105931 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-105931 and fix it if it is affected. What it is: CVE-2026-105931 is a low-severity vulnerability in Apache Pulsar, published on 21 Oct 2026. Exploitation: There is no known exploitation of CVE-2026-105931 in the wild and no public exploit code. Affected product: Apache Pulsar. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-105931/ (Markdown: https://insights.sbomify.com/CVE-2026-105931/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-105931 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105931 - OSV: https://osv.dev/vulnerability/CVE-2026-105931 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-105931/ Summaries are generated and may contain mistakes; the official description above is the record.