Apache Pulsar patches 14 CVEs, including critical auth bypass

Apache Pulsar has fixed fourteen security flaws in versions 4.0.14, 4.2.5, and 5.0.0, including one critical authentication bypass that could grant unauthenticated clients superuser privileges. The Pulsar PMC published the advisories on 21 October 2026 and recommends that operators upgrade.

The critical issue, CVE-2026-105869 (CVSS 9.2), affects deployments that use MultiRolesTokenAuthorizationProvider with a non-empty anonymous user role. When HTTP or WebSocket credentials failed authentication, the broker fell back to the anonymous role yet still honored roles from an unverified bearer token. An attacker could present a forged or unsigned token and obtain any role, including superuser. The bug spans 2.8.1 before 4.0.14 and 4.1.0 before 4.2.5.

Among the remaining advisories are four high-severity findings. One, CVE-2026-105937, let a tenant administrator bind a shadow topic to a persistent topic in another tenant, enabling cross-tenant message reads and deletion of source data. Four medium and five low-severity issues round out the set.

A separate advisory covers CVE-2026-105944 in Apache Pulsar Manager, which has reached end of life. Lari Hotari relayed the combined notice on behalf of the project.