Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role

Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data

Apache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate Validation

Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage

Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation

Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic

Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download

Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint

Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands

Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission

Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all

Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization

Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints

Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants

Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission