# CVE-2026-105936: Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint - **Severity:** Medium 5.3 (`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N`) - **Exploited in the wild:** Not known - **Fix available:** Yes - **Published:** 21 Oct 2026 - **Updated:** 23 Oct 2026 - **Also known as:** GHSA-qrmf-cr66-g64f, MINI-35h5-xr75-cm2x, MINI-5962-j2qp-px9v, MINI-g3qw-vfjm-2g8x, MINI-jmp4-xxpp-49q6 ## What is CVE-2026-105936? CVE-2026-105936 is a medium-severity vulnerability in Apache Pulsar, published on 21 Oct 2026. ### Official description The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint (/admin/v2/worker/connectors) and the deprecated functions connectors endpoint (/admin/v2/functions/connectors and /admin/v3/functions/connectors). When authorization is enabled, the worker connectors endpoint requires super-user access. The functions connectors endpoint, served both by the functions worker and by a broker running the functions worker, returns the same catalog without this check. As a result, when authentication and authorization are enabled, any authenticated client can read the connector catalog through the functions connectors endpoint, regardless of the permissions granted to its role and without super-user access. Unauthenticated requests are rejected unless anonymous access is configured with an anonymous user role. The catalog contains the connector type definitions installed in the functions worker's connectors directory: the connector name, its description, and the source, sink and configuration class names. It does not contain configured source or sink instances, their configuration values or credentials, and an installed connector type does not indicate that a connector is configured or running. The impact is limited to disclosure of this metadata, which can include the names and descriptions of custom connectors installed by the operator. The issue does not allow modifying the catalog or managing connectors. Connector definitions that have a source or sink class are also returned by the built-in sources and sinks endpoints to authenticated clients. In fixed versions, the functions connectors endpoint applies the same checks as the worker connectors endpoint, so that it requires super-user access when authorization is enabled. Clients that are not super-users can use the built-in sources and sinks endpoints to list the available connector types. This issue affects Apache Pulsar versions from 2.4.1 before 4.0.14 and from 4.1.0 before 4.2.5. - 4.0.x version users should upgrade to at least 4.0.14. - 4.1.x and 4.2.x version users should upgrade to at least 4.2.5. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. The currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/. Weakness: CWE-862 (Missing Authorization) ## Which versions are affected by CVE-2026-105936? ## How do I fix CVE-2026-105936? Upgrade to a fixed version. ## Is CVE-2026-105936 being exploited? There is no known exploitation of CVE-2026-105936 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-105936 and fix it if it is affected. What it is: CVE-2026-105936 is a medium-severity vulnerability in Apache Pulsar, published on 21 Oct 2026. Exploitation: There is no known exploitation of CVE-2026-105936 in the wild and no public exploit code. Affected product: Apache Pulsar. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-105936/ (Markdown: https://insights.sbomify.com/CVE-2026-105936/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-105936 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105936 - OSV: https://osv.dev/vulnerability/CVE-2026-105936 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-105936/ Summaries are generated and may contain mistakes; the official description above is the record.