Loading story…
Apache disclosed CVE-2026-105944, a critical authentication and authorization vulnerability affecting every Apache Pulsar Manager release, versions 0.1.0 through 0.4.0. Rated CVSS 4.0 10.0, the flaw allows unauthenticated attackers with network access to abuse proxied Pulsar administration requests and steal configured HTTP authentication credentials. In versions 0.3.0 and later, attackers can also create administrator accounts after initialization and take full control of Pulsar Manager, an administration interface for Apache Pulsar.
Pulsar Manager has been retired, is unsupported, and will receive no fixes. Apache advises users to remove deployments and migrate to an alternative administration interface. Until removal, organizations should restrict access to trusted administrators and assess whether exposed credentials or token-signing keys need replacement. The advisory concerns Pulsar Manager; it does not establish that all Apache Pulsar deployments are affected.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
Lari Hotari published the Apache Pulsar PMC advisory for CVE-2026-105944, rated CVSS 4.0 10.0 and affecting every release from 0.1.0 through 0.4.0. Unauthenticated attackers can abuse proxied administration requests and steal configured credentials; versions 0.3.0 and later also allow unauthorized administrator creation and full console takeover.
The Apache Pulsar PMC retired Pulsar Manager, leaving no maintained or supported versions. The project will receive no further releases or security updates, and the disclosed vulnerabilities will not be fixed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
6 references tracked. Mallory keeps watching after this page renders.
openwall.com
Open sourcecve.org
Open sourcelists.apache.org
Open sourcepulsar.apache.org
Open sourcelists.apache.org
Open sourcepulsar.apache.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache disclosed **CVE-2026-105869**, a critical Apache Pulsar authorization bypass rated **9.2 under CVSS 4.0**, that can let unauthenticated clients obtain arbitrary roles, including superuser privileges. The flaw affects deployments using `MultiRolesTokenAuthorizationProvider` with a non-empty `anonymousUserRole` setting. When failed HTTP authentication falls back to the anonymous role, the authorization provider trusts role claims from forged or unsigned JWTs retained in request headers without verifying their signatures. Eligible broker HTTP and WebSocket requests are affected; Pulsar binary-protocol connections are not. Affected releases span **2.8.1 through versions before 4.0.14**, and **4.1.0 through versions before 4.2.5**. Administrators should upgrade to the applicable patched release, **4.0.14 or 4.2.5**, or newer. Where upgrades are not immediately possible, Apache recommends removing `anonymousUserRole` from broker and WebSocket service configurations or restricting access to those HTTP endpoints to trusted clients. Security teams should prioritize deployments combining the affected authorization provider, anonymous-role fallback, and externally reachable HTTP or WebSocket endpoints.
Oct 21, 2026
Apache disclosed **CVE-2026-42812**, an important-severity vulnerability in Apache Polaris before **1.4.1** that fails to enforce validation on the `write.metadata.path` table property during certain ALTER TABLE-style updates. By changing only that property, a user can cause Polaris to write Apache Iceberg table metadata to an attacker-chosen reachable storage location instead of the intended validated path. In deployments where `polaris.config.allow.unstructured.table.location=true` and `allowedLocations` is broadly configured, the malicious path can be saved and later used by table-load and credential APIs to obtain temporary cloud-storage credentials for that same location without revalidation. Apache warned this can expose or enable modification, corruption, or deletion of data and metadata beyond the targeted table, potentially affecting other prefixes or even bucket or container roots depending on configuration and provider behavior; the underlying validation bypass still exists even when unstructured table locations are disabled, though later checks may prevent the unsafe path from being persisted.
May 4, 2026
Apache disclosed **CVE-2026-64640**, a low-severity vulnerability in `org.apache.polaris:polaris-runtime-service` affecting versions through **1.6.0**. The flaw occurs in the platform's table and view registration flow, where the register endpoint can read an attacker-controlled Iceberg metadata location before verifying that the object is within the catalog's configured allowed storage locations. Under specific conditions, an authenticated user with registration privileges could cause Polaris to perform a server-side read using the catalog's storage credentials, potentially exposing limited information from an object outside the intended storage boundary. Apache said the issue is relevant to deployments using **S3 credential vending** where the underlying storage credentials can access the out-of-bounds object, and reported impact is limited to **confidentiality**, with no demonstrated integrity or availability effects.
Aug 6, 2026