CVE-2026-105935
Description
A flaw was found in Apache Pulsar's Functions Worker. An authenticated user with permissions to manage functions can publish unauthorized messages to restricted topics, compromising message integrity. This issue occurs because the function trigger application programming interface (API) endpoint does not verify whether the caller is authorized to produce messages to the target topic before publishing data using the worker's service credentials. Consequently, topic consumers may receive unauthorized or untrusted messages across different namespaces or tenants.
Statement
This vulnerability is rated as Moderate severity because exploitation requires an authenticated attacker with explicit function management privileges, limiting the blast radius to unauthorized message injection without compromising confidentiality or enabling remote code execution. Although an authenticated principal can bypass topic-level produce authorization via the trigger endpoint, the issue does not permit reading existing topic data. Furthermore, in standard deployments where administrative role assignments are restricted to trusted tenants and operators, the potential for cross-tenant abuse is significantly reduced.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
