{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-105938 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-105938 is a low-severity vulnerability in Apache Pulsar, published on 21 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-105938 and fix it if it is affected.\n\nWhat it is: CVE-2026-105938 is a low-severity vulnerability in Apache Pulsar, published on 21 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-105938 in the wild and no public exploit code.\n\nAffected product: Apache Pulsar. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-105938/ (Markdown: https://insights.sbomify.com/CVE-2026-105938/index.md)","id":"CVE-2026-105938","markdown":"https://insights.sbomify.com/CVE-2026-105938/index.md","name":"CVE-2026-105938","record":{"aliases":["GHSA-2wv9-w73c-5j3r","MINI-3rvq-2p9g-cwxp","MINI-67wq-rc8p-g289","MINI-89h4-ghmr-ph9g","MINI-8qgf-mfj7-rvq9"],"analysis":null,"analysis_generated_by":null,"assigner":"apache","cpe":[],"cvss":{"score":2.3,"severity":"low","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-863","name":"Incorrect Authorization"}],"description":"Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or by granting permission on a subscription to specific roles. Topic-level subscription operations, such as consuming, skipping messages, resetting a cursor or deleting a subscription, apply these subscription policies. Several admin REST API operations that act on subscriptions did not apply them:\n\n- the namespace-level and bundle-level clear backlog operations, both for a named subscription and for all subscriptions;\n- the namespace-level and bundle-level unsubscribe operations;\n- the topic-level operation that expires messages for all subscriptions of a topic.\n\nWith the default authorization provider, the namespace-level operations require only consume permission granted on the namespace, and the expire-all operation requires only consume permission on the topic. As a result, when authentication and authorization are enabled and a namespace uses the Prefix subscription authentication mode or subscription permissions, an authenticated user with such consume permission can clear the backlog of, expire messages of, or delete a subscription that the policies would deny to that user. Tenant admin or superuser access is not required. The clear backlog operations can also be applied to the cursors used for geo-replication, so that messages not yet replicated to a remote cluster are skipped. Deployments that do not configure the Prefix subscription authentication mode or subscription permissions (the defaults) are not affected by this bypass, because consume permission on the namespace or topic already allows these operations there. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be different.\n\nThe impact is on the integrity of subscription state. Clearing or expiring the backlog moves the subscription's cursor forward, so unacknowledged messages are no longer delivered to the subscription's consumers. The unsubscribe operation deletes a subscription that has no connected consumers. Skipped messages can be permanently deleted once no other subscription or the namespace's retention policy keeps them. The issue does not allow reading message contents, changing permissions or policies, or accessing other namespaces, and it does not affect the availability of the broker.\n\nIn fixed versions, the namespace-level and bundle-level operations for a named subscription apply the subscription policies to that subscription, and the operations for all subscriptions, when requested by a user who is not a tenant admin or superuser, only act on the subscriptions that the user may access. Clearing the backlog of geo-replication cursors requires tenant admin or superuser access. Topic-level subscription operations apply the subscription policies for all types of authentication data, including that of the anonymous user role.\n\nThis issue affects Apache Pulsar versions from 2.8.0 before 4.0.14 and from 4.1.0 before 4.2.5.\n\n- 4.0.x version users should upgrade to at least 4.0.14.\n- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.\n\nAll brokers in a cluster must be upgraded before relying on the namespace-level restrictions, because brokers that have not been upgraded do not apply them when they receive the internal per-bundle requests.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.\n\nThe currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.\n\nUsers who cannot upgrade immediately can reduce exposure by restricting network access to the broker's admin REST API to trusted administrative clients.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which req","id":"CVE-2026-105938","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation,","id":"CVE-2026-105941"},"packages":[],"prev":{"headline":"Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger.","id":"CVE-2026-105937"},"products":["Apache Pulsar"],"published":"2026-10-21","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-23","vendors":["Apache Software Foundation"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-105938/"}