Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105944— Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life

Quick assessment

Affected
Apache Software Foundation Apache Pulsar Manager
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Apache Pulsar Manager 是一个用于管理 Apache Pulsar 集群的 Web 控制台。它拥有独立的用户账户和登录机制，并可配置 HTTP 认证凭据（例如令牌），以便代表其用户调用 Pulsar 管理 API。Pulsar Manager 存在以下安全问题： 创建初始管理员（超级用户）账户的操作无需认证即可执行，且该功能在实例初始化后仍然可用。任何能够访问 Pulsar Manager 的用户均可随时创建额外的管理员账户并登录。此问题影响 0.3.0 及更高版本。 Pulsar Manage

CVSS 10.0 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
Apache Software Foundation Apache Pulsar Manager 0.1.0≤ 0.4.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105944

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life
Source: CVE Program / CVE List V5
Vulnerability Description
Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the following security issues: - The operation for creating the initial administrator (superuser) account is available without authentication, and it remains available after the instance has been initialized. Anyone who can reach Pulsar Manager can create an additional administrator account at any time and log in with it. This issue affects versions 0.3.0 and later. - Requests to the Pulsar admin API that Pulsar Manager proxies to the configured Pulsar cluster are not subject to Pulsar Manager's authentication. Version 0.2.0 checks the caller's permissions for some of these requests, but not for all of them. An unauthenticated user can therefore use Pulsar Manager to send requests to the Pulsar admin API, which the cluster processes with the credential configured in Pulsar Manager. - The destination of a proxied request can be chosen by the requester, and Pulsar Manager attaches its configured Pulsar admin credential to the request. An unauthenticated user can make Pulsar Manager send this credential to a host of the user's choosing, and the credential can then be used directly against the Pulsar cluster. - In versions 0.3.0 and later, Pulsar Manager does not distinguish between privilege levels of its accounts. Every account, including one created through the first issue, effectively has full administrative privileges in Pulsar Manager. The impact depends on the version and the deployment. In versions 0.3.0 and later, any user who can reach Pulsar Manager over the network can take full control of Pulsar Manager. In all versions, when Pulsar Manager is configured with an HTTP authentication credential for a Pulsar cluster, any user who can reach Pulsar Manager can perform the Pulsar admin operations that this credential permits and can obtain the credential itself. When Pulsar Manager is configured with the token signing key of a Pulsar cluster, an administrator of Pulsar Manager can create tokens for the cluster. Apache Pulsar Manager is no longer maintained and is completely unsupported. The Apache Pulsar PMC has retired it. There are no supported versions, and no further releases, fixes or security updates will be made for any version. These issues will not be fixed. Using Pulsar Manager is not recommended. Users should stop using Pulsar Manager, remove existing deployments, and move to one of the alternatives described in the Administration UI documentation (https://pulsar.apache.org/docs/administration-ui). Users who have exposed Pulsar Manager configured with a Pulsar credential or token signing key should also consider replacing that credential or key. Until a deployment is removed, users should not expose Pulsar Manager to untrusted networks, and should restrict network access to it to trusted administrators.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Apache Software Foundation Apache Pulsar Manager 0.1.0 ~ 0.4.0 -

II. Public POCs for CVE-2026-105944

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105944

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-105944 (1)

Mailing List Discussions for CVE-2026-105944 (1)

Vendor Pages for CVE-2026-105944 (1)

Same Patch Batch · Apache Software Foundation · 2026-10-21 · 69 CVEs total

CVE-2026-111813 10.0 CRITICAL Apache Traffic Server: magick plugin passes client query strings unfiltered to ImageMagick
CVE-2026-111812 10.0 CRITICAL Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the pr
CVE-2026-111814 10.0 CRITICAL Apache Traffic Server: Default server_session_sharing.match omits MASK_CERT, allowing pool
CVE-2026-111815 10.0 CRITICAL Apache Traffic Server: TLS session ticket resumption bypasses per-SNI verify_client STRICT
CVE-2026-111816 9.3 CRITICAL Apache Traffic Server: A malformed 302 response bypasses parse-error rejection through the
CVE-2026-111809 9.3 CRITICAL Apache Traffic Server: HEAD requests carrying Content-Length or Transfer-Encoding enable r
CVE-2026-105869 9.2 CRITICAL Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for
CVE-2026-111811 9.0 CRITICAL Apache Traffic Server: tsmemcache plugin exposes the shared proxy cache over the network w
CVE-2025-31699 8.9 HIGH Apache Traffic Server: Origin connection still owed a request body is reused, enabling req
CVE-2025-55702 8.7 HIGH Apache Traffic Server: An unread Expect: 100-continue request body is framed as a new requ
CVE-2026-105937 8.7 HIGH Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant messag
CVE-2026-111808 8.6 HIGH Apache Traffic Server: HTTP/2 DATA frame padding underflow lets a client trigger backend w
CVE-2026-111805 8.6 HIGH Apache Traffic Server: HTTP/2 Content-Length truncation lets a client trigger backend work
CVE-2026-111804 8.2 HIGH Apache Traffic Server: wasm plugin has a use-after-free and forwards unvalidated guest met
CVE-2026-105945 7.7 HIGH Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package
CVE-2026-105942 7.7 HIGH Apache Pulsar: Original principal of proxied requests authorized with the proxy's authenti
CVE-2026-111810 7.5 HIGH Apache Traffic Server: Unthrottled per-header diagnostic logging enables a log-flood denia
CVE-2026-105934 7.2 HIGH Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topi
CVE-2026-105930 6.0 MEDIUM Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cro
CVE-2026-112381 5.9 MEDIUM Apache Traffic Server: Nullptr dereference in net_write_io on a POST half-close with chunk

Showing top 20 of 69 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same vendor: Apache Software Foundation
Same weakness: CWE-306

V. Comments for CVE-2026-105944

No comments yet

Leave a comment