{"id":"CVE-2026-105927","kind":"vulnerability","aliases":["CVE-2026-105927"],"related":[],"title":"Apache Pulsar: WebSocket consumers can inject messages into unauthorized topics","description":"The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including the deadLetterTopic parameter that names the topic to which messages are written after the maximum number of redeliveries is exceeded. When authorization is enabled, the WebSocket service checks only that the connecting user holds the CONSUME permission on the subscribed topic. It does not check whether the user holds the PRODUCE permission on the topic named in deadLetterTopic. The dead letter messages are then written by the WebSocket service using its own broker client identity rather than the identity of the connecting user.\n\nAs a result, an authenticated user who holds the CONSUME permission on at least one topic can cause messages to be written to a topic of their choosing in any existing namespace, including namespaces belonging to other tenants, provided the role used by the WebSocket service to connect to the brokers is authorized to produce to that topic and the topic accepts a producer that registers no schema. The dead letter producer created by the WebSocket service registers no schema, so it is rejected when the target topic has a schema and schema validation is enforced for that topic or its namespace; this setting is not enabled by default. The same user is refused when attempting to produce to that topic directly. Where automatic topic creation is enabled, which is the default, the named topic is created if it does not already exist. The issue can only be triggered when the WebSocket service is enabled, either in the broker (webSocketServiceEnabled, which is disabled by default) or as a standalone WebSocket proxy.\n\nThe impact is unauthorized injection of messages into topics the user is not permitted to produce to. The user can determine the content of the injected messages when they also control the messages on the subscribed topic. The issue does not allow reading, modifying or deleting existing messages in the target topic. Injected messages carry the dead letter message properties and a dead letter producer name, so they can be distinguished from messages produced normally; however, the values of these properties are not authenticated and should not be relied upon to establish the origin of a message. Whether an injected message has further consequences depends on how the applications consuming the target topic process it. Repeated injection also consumes storage and backlog capacity in the target namespace.\n\nThis issue affects Apache Pulsar versions from 2.3.0 before 4.0.14 and from 4.1.0 before 4.2.5.\n\n- 4.0.x version users should upgrade to at least 4.0.14.\n- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.\n\nThe currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.\n\nUsers who cannot upgrade immediately and do not require the WebSocket service should disable it. Where the WebSocket service is required, restricting network access to it and limiting the permissions granted to the role the WebSocket service uses to connect to the brokers to the namespaces WebSocket clients are intended to access reduces the exposure.","summary":"An authenticated WebSocket consumer can name any topic as a dead letter destination, and the WebSocket service writes to it using its own broker identity, skipping the produce permission check. An attacker can inject messages into topics they cannot produce to, across tenants, if the service role may produce there.","severity":"low","cvss":2.3,"epss":0.00437,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["multi-tenant","package","pulsar","self-hosted","websocket"],"not_affected_if":["default-config","no-authorization","websocket-service-disabled"],"how_to_check":"- Check whether the WebSocket service is enabled: `webSocketServiceEnabled=true` in broker.conf, or a standalone WebSocket proxy is running\n- Check the Pulsar version with `pulsar version`; affected versions are 2.3.0 up to but not including 4.0.14, and 4.1.0 up to but not including 4.2.5\n- Check whether authorization is enabled: `authorizationEnabled=true` in broker.conf","fix":"- Upgrade 4.0.x installs to `4.0.14` or newer\n- Upgrade 4.1.x and 4.2.x installs to `4.2.5` or newer\n- Until upgraded, disable the WebSocket service by setting `webSocketServiceEnabled=false`, or restrict network access to it and limit the WebSocket service role's produce permissions to the namespaces its clients need","status":"open","published_at":"2026-10-21T18:17:22+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:49:45+00:00","updated_at":"2026-10-25T04:49:45+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T04:49:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade 4.0.x installs to `4.0.14` or newer\n- Upgrade 4.1.x and 4.2.x installs to `4.2.5` or newer\n- Until upgraded, disable the WebSocket service by setting `webSocketServiceEnabled=false`, or restrict network access to it and limit the WebSocket service role's produce permissions to the namespaces its clients need","reach":"network","title":"Apache Pulsar: WebSocket consumers can inject messages into unauthorized topics","impact":"medium","summary":"An authenticated WebSocket consumer can name any topic as a dead letter destination, and the WebSocket service writes to it using its own broker identity, skipping the produce permission check. An attacker can inject messages into topics they cannot produce to, across tenants, if the service role may produce there.","category":"package","nicknames":[],"who_cares":["pulsar","self-hosted","websocket","multi-tenant"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker injects forged messages into topics they cannot produce to","analyst_note":"","how_to_check":"- Check whether the WebSocket service is enabled: `webSocketServiceEnabled=true` in broker.conf, or a standalone WebSocket proxy is running\n- Check the Pulsar version with `pulsar version`; affected versions are 2.3.0 up to but not including 4.0.14, and 4.1.0 up to but not including 4.2.5\n- Check whether authorization is enabled: `authorizationEnabled=true` in broker.conf","needs_analyst":false,"not_affected_if":["websocket-service-disabled","no-authorization","default-config"],"who_is_affected":"Only deployments that run the Pulsar WebSocket service, either in the broker or as a standalone WebSocket proxy, with authorization enabled are exposed. The attacker needs a user account that holds consume permission on at least one topic, and the service role must be allowed to produce to the target topic. Deployments that do not run the WebSocket service can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000797,"input_tokens":4293,"output_tokens":735,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-105927':13A,16A '-2026':12A,15A '/contribute/release-policy/.':557C '2.3.0':486C '4.0':494C,543C '4.0.14':488C,503C '4.1':504C '4.1.0':491C '4.2':507C '4.2.5':493C,516C '5.0':546C 'accept':242C 'access':581C,609C 'across':67B 'affect':481C 'aforement':529C 'allow':80C,393C 'alreadi':322C 'also':381C,469C 'apach':1A,76C,482C,538C 'applic':460C 'attack':57B 'attempt':296C 'authent':27B,185C,435C 'author':119C,233C 'automat':304C 'avail':553C 'backlog':473C 'belong':215C 'broker':49B,170C,231C,339C,600C 'cannot':64B,560C 'capac':474C 'carri':406C 'caus':198C 'check':55B,125C,142C 'choos':208C 'client':171C,605C 'configur':85C 'connect':129C,179C,228C,597C 'consequ':455C 'consum':4A,29B,83C,95C,133C,190C,461C,470C 'content':374C 'control':382C 'creat':253C,317C 'creation':306C 'current':536C 'cve':11A,14A 'dead':36B,87C,157C,250C,408C,414C 'deadlettertop':99C,155C 'default':289C,312C,345C 'delet':397C 'depend':456C 'destin':38B 'determin':372C 'direct':302C 'disabl':343C,571C 'distinguish':422C 'either':336C 'enabl':121C,287C,308C,335C 'endpoint':96C 'enforc':276C 'establish':443C 'exceed':117C 'exist':211C,323C,398C 'exposur':612C 'grant':588C 'hold':131C,146C,188C 'host':24B 'howev':427C 'ident':50B,172C,176C 'immedi':562C 'impact':353C 'includ':97C,213C 'inject':6A,59B,356C,377C,404C,451C,468C 'intend':607C 'issu':325C,390C,480C 'least':194C,502C,515C 'letter':37B,88C,158C,251C,409C,415C 'limit':585C 'line':541C 'list':523C 'maximum':112C 'may':73B 'messag':7A,60B,107C,159C,199C,358C,378C,384C,399C,405C,410C,424C,448C,452C 'modifi':395C 'multi':18B 'multi-ten':17B 'name':31B,102C,153C,314C,417C 'namespac':212C,214C,282C,478C,603C 'network':580C 'newer':533C 'normal':426C 'number':113C 'one':195C 'oper':518C 'origin':445C 'packag':20B 'paramet':92C,100C 'patch':530C 'permiss':54B,134C,149C,191C,587C 'permit':365C 'polici':89C 'prior':520C 'process':465C 'produc':53B,65B,74B,148C,235C,244C,252C,298C,367C,416C,425C 'properti':411C,432C 'provid':219C 'proxi':351C 'pulsar':2A,21B,77C,483C,539C 'pulsar.apache.org':556C 'pulsar.apache.org/contribute/release-policy/.':555C 'queri':91C 'rather':173C 'read':394C 'redeliveri':115C 'reduc':610C 'refus':294C 'regist':246C,258C 'reject':264C 'releas':540C 'reli':440C 'repeat':467C 'requir':566C,578C 'restrict':579C 'result':183C 'role':72B,221C,591C 'schedul':551C 'schema':248C,260C,271C,273C 'self':23B 'self-host':22B 'servic':42B,71B,79C,124C,166C,226C,257C,333C,569C,576C,594C 'set':284C 'skip':51B 'standalon':349C 'storag':471C 'subscrib':137C,387C 'support':537C,549C 'target':267C,402C,463C,477C 'tenant':19B,68B,218C 'topic':10A,33B,62B,104C,138C,152C,196C,205C,238C,241C,268C,279C,301C,305C,315C,360C,388C,403C,464C 'trigger':329C 'unauthor':9A,355C 'upgrad':499C,512C,526C,561C 'upon':441C 'use':46B,167C,222C,595C 'user':130C,145C,180C,186C,292C,362C,370C,497C,510C,517C,558C 'valid':274C 'valu':429C 'version':484C,496C,509C,519C,531C,534C,550C 'websocket':3A,25B,28B,41B,78C,82C,123C,165C,225C,256C,332C,350C,568C,575C,593C,604C 'websocketserviceen':340C 'whether':143C,449C 'write':43B 'written':109C,162C,202C 'x':495C,505C,508C,544C,547C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that run the Pulsar WebSocket service, either in the broker or as a standalone WebSocket proxy, with authorization enabled are exposed. The attacker needs a user account that holds consume permission on at least one topic, and the service role must be allowed to produce to the target topic. Deployments that do not run the WebSocket service can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105927","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105927","severity":null,"published_at":"2026-10-21T18:17:22+00:00","modified_at":"2026-10-22T16:56:52+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-105927","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105927","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}