Servers, proxies and network services

Apache Pulsar: CVE-2026-105869, CVE-2026-105942 and Pulsar Manager CVE-2026-105944

Apache Pulsar check

The Apache Pulsar PMC published 14 advisories on 21 October 2026, all fixed in 4.0.14, 4.2.5 and 5.0.0, and a separate advisory for Pulsar Manager, which has reached end of life. This tool covers three of them, the ones whose exposure depends on configuration or on what is installed.

None of the two broker flaws is reachable on a default broker. Pulsar's shipped broker.conf has authenticationEnabled=false, authorizationEnabled=false, an empty anonymousUserRole and an empty proxyRoles.

The other twelve advisories in the 21 October announcement (cross-tenant access, missing authorization checks and similar) are fixed by the same upgrade. They are not counted separately here.

Quick start

1. Download the script. The repository is mirrored on GitHub and Codeberg; pick a base URL.

   # BASE from GitHub:   https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main
   # BASE from Codeberg: https://codeberg.org/PrivacySafe/security-patches/raw/branch/main
   # curl -fLO "$BASE/pulsar/pulsar-check.sh"
   curl -fLO https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main/pulsar/pulsar-check.sh
   

2. Read it before running it, then make it executable.

   less pulsar-check.sh
   chmod +x pulsar-check.sh
   

3. Check this host. By default it searches /opt /srv /usr/local /var/lib /etc /home /root; pass directories to narrow it.

   ./pulsar-check.sh check
   ./pulsar-check.sh check /opt/pulsar
   

Commands

Exit codes: 0 nothing exposed, 1 an affected broker with an exposing configuration (or whose configuration could not be read), an exposing configuration of unknown version, or Pulsar Manager present, 2 bad arguments.

How to read the result

• Broker in an affected range and the exposing settings present: exposed. Upgrade to 4.0.14, 4.2.5 or 5.0.0 or newer. Until then (PrivacySafe recommendation): empty anonymousUserRole, do not expose the HTTP and WebSocket ports to untrusted clients, and keep the broker behind the proxy with strict network rules.
• Affected range, no exposing settings: exit 0 with a reminder that the upgrade is still needed.
• Affected broker with no conf/ beside it: reported as exposed, exit 1, so you review it with the settings in hand (they may come from environment variables or a mounted file).
• A fixed broker (4.0.14 and later, 4.2.5 and later, 5.0.0 and later) is fine even if its configuration contains the settings: the check is on the version, and the file is not flagged separately.
• Versions older than 2.8.1: the two configuration-dependent flaws start at 2.8.1, but those releases are unsupported and affected by other advisories in the set: upgrade.
• Containers: a compose file or Helm values file with the exposing settings is reported without a version, because the image is not opened. Check the tag: below 4.0.14, any 4.1.x, or 4.2.x below 4.2.5 is exposed.
• Pulsar Manager, any version, any state: stop and remove it. If it was reachable from a network you do not fully trust, treat the Pulsar credential or token signing key it held as compromised and replace it, and check its user list for administrators you did not create. The Pulsar documentation lists alternatives: https://pulsar.apache.org/docs/administration-ui

Sources

• Advisory for CVE-2026-105869
• The Pulsar PMC's combined announcement of 14 CVEs (oss-security)

Before you run it

• The fix. Brokers: update to 4.0.14, 4.2.5 or 5.0.0. The Pulsar PMC retired Pulsar Manager: stop using it and remove it.
• The broker flaws depend on configuration. Neither CVE-2026-105869 nor CVE-2026-105942 is reachable on a default broker: authentication, authorization, anonymousUserRole and proxyRoles are off or empty by default. The script reads broker.conf, standalone.conf, configuration, compose, Helm and env files for the exposing settings.
• It does not open container images. For containers it reads the files beside them and tells you to check the tag. It also looks for Pulsar Manager (jars, running processes, listeners on 7750 and 9527).
• There is no hunt. No indicators of exploitation have been published.
• It also checks running docker and podman containers, unless you name a directory or set SCAN_CONTAINERS=0. In each running container, a read-only probe copies the broker jar names as empty files, because only the name carries the version. From each broker.conf, standalone.conf, compose, Helm and .env file it copies only the lines that mention authorizationProvider, anonymousUserRole, authorizationEnabled or proxyRoles, so token secrets and client credentials never leave the container. A broker.conf that has none of those settings is still staged, so it is reported as clean rather than as unreadable. The script runs once per container in isolation. /pulsar, where the official image installs, is searched in containers.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.

Edit this page on Codeberg