Apache Pulsar vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

AP

Product

Apache Pulsar

by Apache Software Foundation · last CVE Oct 21, 2026

15

CVEs

0

On KEV

9.2

Max CVSS

14

New 30D

Vulnerabilities15 In the news0 Timeline

Severity mix

Critical 1High 5Medium 4Low 5

Severity

All severities15 Critical1 High5 Medium4 Low5

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Apache Pulsar to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-105930 New	6.0	0%	Oct 21	Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download Affected: 2.8.0 before 4.0.14; 4.1.0 through 4.1.3; 4.2.0 before 4.2.5
CVE-2026-105936 New	5.3	1%	Oct 21	Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint Affected: 2.4.1 before 4.0.14; 4.1.0 before 4.2.5
CVE-2026-105926 New	5.3	0%	Oct 21	Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands Affected: 2.2.0 before 4.0.14; 4.1.0 through 4.1.3; 4.2.0 before 4.2.5
CVE-2026-105935 New	4.9	0%	Oct 21	Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission Affected: 2.0.0-rc1-incubating before 4.0.14; 4.1.0 before 4.2.5