Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Pulsar

30 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.2
    CVE-2026-105869

    Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role

    Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorization. The provider did …

    Apache Software Foundation Apache Pulsar
  • Critical 9.6
    CVE-2023-30429

    Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy

    Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When a client connects to the Pulsar Function Worker via the Pulsar Proxy where the Pulsar Proxy uses mTLS authenti…

    Apache Software Foundation Apache Pulsar org.apache.pulsar:pulsar Maven
  • Critical 9.8
    CVE-2021-22160 EPSS 53%

    Authentication with JWT allows use of “none”-algorithm

    If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as…

    Apache Software Foundation Apache Pulsar org.apache.pulsar:pulsar Maven