{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-105932 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-105932 is a low-severity vulnerability in Apache Pulsar, published on 21 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-105932 and fix it if it is affected.\n\nWhat it is: CVE-2026-105932 is a low-severity vulnerability in Apache Pulsar, published on 21 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-105932 in the wild and no public exploit code.\n\nAffected product: Apache Pulsar. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-105932/ (Markdown: https://insights.sbomify.com/CVE-2026-105932/index.md)","id":"CVE-2026-105932","markdown":"https://insights.sbomify.com/CVE-2026-105932/index.md","name":"CVE-2026-105932","record":{"aliases":["GHSA-6xq3-9hvx-9qxg","MINI-95wr-2285-rvw4","MINI-g65j-753x-rrqf","MINI-mpc9-38vp-769w","MINI-pwpw-v2m8-328r"],"analysis":null,"analysis_generated_by":null,"assigner":"apache","cpe":[],"cvss":{"score":2.3,"severity":"low","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-862","name":"Missing Authorization"}],"description":"The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persistent topics these endpoints check that the caller is authorized for the entry filters topic policy operation. The corresponding endpoints for non-persistent topics (/admin/v2/non-persistent/{tenant}/{namespace}/{topic}/entryFilters) do not perform this authorization check. The only authorization check these endpoints perform is an indirect lookup permission check, made while the topic's partition metadata is retrieved; it is present in all affected versions.\n\nAs a result, when authentication and authorization are enabled, an authenticated user who has been granted produce or consume permission on a non-persistent topic, or on its namespace, but not permission to manage the topic's policies can read, replace or remove the topic-level entry filter policy of that topic. These operations should be restricted to users with the tenant admin role or the superuser role. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be slightly different.\n\nThe practical impact is limited by two broker configuration requirements, neither of which is met by default:\n\n- Entry filters must have been installed by the operator. Entry filter implementations are loaded only at broker startup from the broker's entry filters directory, which is empty by default. A request can only select among entry filters the operator has already deployed; setting any other filter name is rejected. The issue does not allow a caller to install or load entry filter code or to run arbitrary code in the broker.\n- Topic-level entry filter policies must be allowed to override the broker-level configuration (allowOverrideEntryFilters, which is disabled by default). When this setting is disabled, the topic-level entry filter policy has no effect on message dispatch.\n\nIn deployments where both conditions are met, an unauthorized user can remove the topic-level entry filter policy of a non-persistent topic, for example one used to restrict which messages are delivered to consumers, or apply a different installed entry filter that withholds messages from subscriptions of that topic. Removing it makes the topic fall back to the namespace-level or broker-level entry filters, which are not removed. A changed policy affects only subscription dispatchers created after the change, for example for new subscriptions or when a subscription is re-created after all of its consumers have disconnected; dispatchers that already exist keep the entry filters they were created with. Because non-persistent topics do not store messages, messages withheld by an entry filter are not delivered. Reading the policy discloses only the names of the configured entry filters. The issue does not allow reading message contents, and entry filters cannot modify message payloads. Persistent topics and namespace-level entry filter policies are not affected. Apache Pulsar versions before 3.3.0 are not affected, because in those versions the entry filters topic policy check is made in code shared by the persistent and non-persistent endpoints.\n\nThis issue affects Apache Pulsar versions from 3.3.0 before 4.0.14 and from 4.1.0 before 4.2.5.\n\n- 3.3.x and 4.0.x version users should upgrade to at least 4.0.14.\n- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.\n\nThe currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.\n\nUsers who cannot upgrade immediately and have deployed entry filters should keep allowOverrideEntryFilters at its default value of false, so that topic-level entry filter policies do not affect message dispatch.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints","id":"CVE-2026-105932","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization","id":"CVE-2026-105933"},"packages":[],"prev":{"headline":"The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions.","id":"CVE-2026-105931"},"products":["Apache Pulsar"],"published":"2026-10-21","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-23","vendors":["Apache Software Foundation"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-105932/"}