CVE-2026-105930
Description
A flaw was found in Apache Pulsar's Functions worker. When package management is enabled, the worker authorizes package URL requests using its own internal credentials rather than validating the permissions of the requesting user. An authenticated attacker can exploit this flaw by specifying a package URL from another tenant's namespace, leading to information disclosure of sensitive package contents such as application code, business logic, or embedded credentials.
Statement
This vulnerability is evaluated as Moderate severity because exploitation requires an authenticated user with permissions to deploy or manage Pulsar components, and the potential impact is strictly confined to unauthorized read access across tenant namespaces without affecting service availability or data integrity. Furthermore, package management capabilities are disabled by default in standard configurations, substantially reducing exposure. Systems are only vulnerable when multi-tenancy authorization and package management settings are actively turned on.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Access control checks for specific user data or functionality can be bypassed.
Access Control
Technical Impact: Gain Privileges or Assume Identity
Horizontal escalation of privilege is possible (one user can view/modify information of another user).
Access Control
Technical Impact: Gain Privileges or Assume Identity
Vertical escalation of privilege is possible if the user-controlled key is actually a flag that indicates administrator status, allowing the attacker to gain administrative access.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
