Do Son 
TL;DR
The Apache Software Foundation disclosed 17 security flaws on October 21, 2026. These include 13 Apache Pulsar vulnerabilities and four Apache IoTDB bugs. The most severe issues include a 10.0 CVSS flaw in the retired Pulsar Manager tool. There is also a 9.2 CVSS token bypass in Pulsar, and a root privilege bypass in IoTDB. Therefore, administrators must upgrade their clusters immediately. They must also decommission unsupported management consoles.
- Total: 17 CVEs
- Severity: 2 Critical · 4 High · 4 Medium · 3 Low · 4 Unrated
- Actively exploited: None confirmed
- Highest severity: 10.0 (Critical · CVSSv4) — CVE-2026-105944
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv4) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-105944 | 10 | Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life | — | Not exploited |
| CVE-2026-105869 | 9.2 | MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role | 4.0.14, 4.2.5 | Not exploited |
| CVE-2026-105937 | 8.7 | Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data | 4.0.14, 4.2.5 | Not exploited |
| CVE-2026-105945 | 7.7 | Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage | 4.0.14, 4.2.5 | Not exploited |
| CVE-2026-105942 | 7.7 | Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation | 4.0.14, 4.2.5 | Not exploited |
| CVE-2026-105934 | 7.2 | Missing tenant admin authorization check when truncating a partitioned topic | 4.0.14, 4.2.5 | Not exploited |
| CVE-2026-105930 | 6 | Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download | 4.0.14, 4.2.5 | Not exploited |
| CVE-2026-105936 | 5.3 | Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint | 4.0.14, 4.2.5 | Not exploited |
Why It Matters
Apache Pulsar is a cloud-native distributed messaging and streaming platform. In contrast, Apache IoTDB is an industrial Internet of Things time-series database. Although exact global deployment counts are not specified in the advisories, thousands of enterprises rely on both systems. These platforms process real-time telemetry and event streams.
Leaving these Apache Pulsar vulnerabilities and IoTDB flaws unpatched exposes multi-tenant data streams and time-series databases to unauthorized takeover, cross-tenant data loss, and credential theft. Currently, no public proof-of-concept exists. In addition, no active exploitation in the wild has been confirmed for any of the 17 vulnerabilities.
How the Attack Works
The two security advisories cover distinct authentication bypasses, missing authorization checks, and path traversal flaws across both ecosystems.
Critical Apache Pulsar and Pulsar Manager Flaws
First, CVE-2026-105944 carries a maximum CVSS v4.0 score of 10.0 in Apache Pulsar Manager. The initial superuser creation endpoint requires no authentication and remains open after setup. Furthermore, unauthenticated users can proxy admin API requests or redirect requests to an external host. This can allow them to steal the configured Pulsar admin credential.
Next, CVE-2026-105869 (CVSS 9.2) affects Pulsar’s MultiRolesTokenAuthorizationProvider when anonymousUserRole is configured. When an HTTP or WebSocket request fails authentication and falls back to the anonymous role, the provider reads the Authorization header’s bearer token. However, it does so without verifying its cryptographic signature. Consequently, unauthenticated attackers can send forged or unsigned JWTs listing superuser roles to gain full administrative control.
High and Medium-Severity Pulsar Authorization Bypasses
Several other Apache Pulsar vulnerabilities break tenant isolation. Specifically, CVE-2026-105937 (CVSS 8.7) allows a tenant admin to bind a shadow topic to a source topic in another tenant via the PULSAR.SHADOW_SOURCE property without authorization. This exposes retained messages and allows permanent deletion of the source topic’s BookKeeper ledgers. Meanwhile, CVE-2026-105945 (CVSS 7.7) is a path traversal flaw in the FileSystemPackagesStorageProvider. Here, unvalidated package version strings allow cross-tenant package overwrites or deletions.
Additionally, CVE-2026-105942 (CVSS 7.7) authorizes proxied requests using the proxy’s own token or tenant admin role rather than the original principal’s permissions. In CVE-2026-105934 (CVSS 7.2), the broker truncates partitioned topics using its internal admin client identity. Consequently, non-admin users with lookup permissions can delete topic backlogs. Other Pulsar fixes address cross-tenant package downloads (CVE-2026-105930) and unauthorized function connector listings (CVE-2026-105936). They also address binary protocol schema modifications (CVE-2026-105926), unauthorized function triggers (CVE-2026-105935), subscription policy bypasses (CVE-2026-105938), and encryption requirement fail-open bugs (CVE-2026-105933). In addition, there are fixes for non-persistent entry filter modifications (CVE-2026-105932), transaction metadata leaks (CVE-2026-105931), and WebSocket dead-letter topic writes (CVE-2026-105927).
Apache IoTDB Authentication and Privilege Bypasses
In parallel, Apache disclosed four flaws in Apache IoTDB. Most notably, CVE-2026-59229 stems from the Legacy Pipe receiver protocol (handshake and sendPipeData) using a hardcoded SUPER_USER (root) identity. Consequently, a user with only SYSTEM-level privileges like USE_PIPE or MAINTAIN can send crafted PipeData messages to load or delete data as root across any database. Furthermore, CVE-2026-58663 enables authentication bypass in the Thrift RPC service. Additionally, CVE-2026-59562 involves missing authentication for a critical function, and CVE-2026-41114 triggers uncontrolled resource consumption in the IoTDB JDBC driver.
Affected Versions
The disclosed Apache Pulsar vulnerabilities affect versions starting from 1.22.0-incubating through versions prior to 4.0.14. They also affect versions 4.1.0 before 4.2.5. CVE-2026-105944 affects all Apache Pulsar Manager releases from 0.1.0 through 0.4.0. For Apache IoTDB, CVE-2026-59562, CVE-2026-59229, and CVE-2026-58663 impact versions 2.0.0 before 2.0.11. In addition, CVE-2026-41114 affects the IoTDB JDBC driver from 1.3.3 before 2.0.11.
Patch and Mitigation Steps
Because the Apache Pulsar PMC has retired Pulsar Manager, CVE-2026-105944 will not be patched. Administrators must remove Pulsar Manager deployments immediately and rotate any exposed cluster credentials or token signing keys. For the remaining broker flaws, operators should upgrade to version 4.0.14 or 4.2.5 via the official Apache Pulsar download page. Note that shadow topics are now disabled by default unless enableShadowTopics=true is configured.
Similarly, database administrators must upgrade IoTDB installations and JDBC drivers to version 2.0.11 from the Apache IoTDB download portal to remediate all four database vulnerabilities.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
