Loading vulnerability…
CVE-2026-105944 comprises authentication, authorization, and credential-disclosure vulnerabilities affecting all Apache Pulsar Manager releases, versions 0.1.0 through 0.4.0. In versions 0.3.0 and later, the initial administrator account creation operation remains accessible without authentication after initialization, allowing attackers to create administrator accounts. These versions also lack account privilege separation, effectively granting every account full administrative privileges. Across all affected versions, proxied Pulsar admin API requests are not subject to Pulsar Manager authentication; version 0.2.0 checks permissions for only some requests. Requesters can also select the proxy destination, causing Pulsar Manager to send its configured Pulsar HTTP authentication credential to an attacker-controlled host. These weaknesses enable management-console takeover and unauthorized cluster administration within the configured credential's permissions.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Apache Pulsar Manager has multiple authentication, authorization, and credential-disclosure issues grouped under this CVE. Versions 0.3.0 and later allow unauthenticated creation of administrator accounts and do not distinguish account privilege levels, enabling full Manager takeover. Across all versions, insufficiently authenticated proxy requests allow attackers to invoke Pulsar admin operations using Manager's configured credential and exfiltrate that credential through a requester-controlled destination. A Manager administrator can also create cluster tokens if Manager holds the cluster's token signing key. Pulsar Manager is retired and unsupported; no fixes will be issued. Users should remove deployments and migrate to an alternative administration UI, consider replacing exposed credentials or signing keys, and restrict network access to trusted administrators until removal.
Critical vulnerability in Apache Pulsar Manager, rated CVSS 4.0 10.0, encompassing missing authentication and authorization and disclosure of configured Pulsar administrative credentials. Versions 0.3.0 and later permit unauthenticated administrator account creation and provide all accounts full administrative privileges. Across all versions, unauthenticated proxy requests can exercise configured Pulsar cluster permissions and disclose the configured credential to an attacker-controlled destination. Administrators can also create cluster tokens when a token signing key is configured. Pulsar Manager is retired and unsupported; no fixes will be released. Recommended actions are to remove deployments, migrate to an alternative administration UI, consider replacing exposed credentials or signing keys, and restrict network access to trusted administrators until removal.
A critical vulnerability affecting all Apache Pulsar Manager releases, versions 0.1.0 through 0.4.0, with a CVSS 4.0 score of 10.0. Missing authentication and authorization allow unauthenticated users to proxy Pulsar administrative requests using the configured cluster credential and disclose that credential by directing requests to an attacker-controlled host. Versions 0.3.0 and later additionally allow unauthenticated creation of administrator accounts after initialization and grant every account full administrative privileges. Cluster impact depends on the configured credential's permissions; Pulsar Manager administrators can also create cluster tokens when a token signing key is configured. Pulsar Manager is retired and unsupported, and no fixes will be released. Users should remove deployments, migrate to an alternative, and consider replacing exposed credentials or signing keys. Until removal, network access should be restricted to trusted administrators.
A critical vulnerability with a reported CVSS 4.0 score of 10.0 affects Apache Pulsar Manager 0.1.0–0.4.0. Unauthenticated users can proxy Pulsar admin API requests using the configured cluster credential and redirect requests to disclose that credential. In versions 0.3.0 and later, unauthenticated administrator creation and missing privilege separation allow full takeover of Pulsar Manager. Cluster impact depends on the configured credential's permissions; administrators can also create cluster tokens when a token signing key is configured. No fixes will be released. Users should remove deployments, migrate to an alternative administration UI, and consider replacing exposed credentials or signing keys. Until removal, network access should be restricted to trusted administrators.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.