{"id":"CVE-2026-105942","kind":"vulnerability","aliases":["CVE-2026-105942"],"related":[],"title":"Apache Pulsar: proxy role lets forwarded users exceed their own permissions","description":"When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the original principal cannot exceed its own permissions. Two flaws weakened this check.\n\nFirst, the original principal was authorized with the proxy's authentication data instead of its own. On the admin REST API of the broker and the functions worker, this applied to every proxied request. On the Pulsar binary protocol, it applied when the proxy did not forward the client's credentials to the broker, which was the default of the Pulsar proxy in the affected versions. Authorization providers that resolve permissions from the role name only, such as the default authorization provider, are not affected by this flaw. The multi-role token authorization provider (MultiRolesTokenAuthorizationProvider), added in Apache Pulsar 2.8.1, resolves roles from the role claim of the token in the authentication data it is given. When a proxy authenticates to the broker with its own token, the original principal was therefore authorized with all roles in the proxy's token. If any of those roles is a superuser or tenant admin role, any user whose requests are forwarded by that proxy can perform operations that need those permissions without holding them. Custom authorization providers that use the authentication data could be affected in a similar way.\n\nSecond, independently of the authorization provider, the tenant admin check of a proxied admin REST API request succeeded without checking the original principal when the proxy role was itself an admin role of the tenant. In deployments where a proxy role is a tenant admin, including with the default authorization provider, any user whose requests are forwarded by that proxy could perform tenant administration operations on that tenant. This behavior is present from 2.8.4 in the 2.8.x releases, from 2.9.3 in the 2.9.x releases, and from 2.10.1 onwards.\n\nDeployments that use neither the multi-role token authorization provider nor a custom provider that uses the authentication data are not affected by the first flaw, and with the multi-role token authorization provider, neither are deployments whose proxies do not authenticate to the broker with a token. Deployments in which no proxy role is listed as an admin role of a tenant are not affected by the second flaw. A proxy role that is a superuser but is not listed as a tenant admin does not trigger it, because the tenant admin check of the built-in authorization providers only considers the tenant's admin roles; this can differ for custom authorization providers that treat superusers as tenant admins.\n\nIn fixed versions, both the proxy role and the original principal are authorized for each proxied request, and the original principal is authorized only with its own authentication data. With the multi-role token authorization provider, the roles of a forwarded token are used for the original principal only when that token authenticates as the original principal; otherwise only the original principal's role name is used. For tenant admin checks, the proxy role and the original principal must each be a superuser or a tenant admin of the tenant.\n\nThis issue affects Apache Pulsar versions from 2.8.1 before 4.0.14 and from 4.1.0 before 4.2.5.\n\n- 4.0.x version users should upgrade to at least 4.0.14.\n- 4.1.x and 4.2.x version users should upgrade to at least 4.2.5.\n\nUsers operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.\n\nThe currently supported Apache Pulsar release lines are 4.0.x and 5.0.x. The supported versions schedule is available at https://pulsar.apache.org/contribute/release-policy/.","summary":"When a Pulsar proxy forwards a user's request to the broker, the broker authorizes the user with the proxy's credentials instead of the user's own, and tenant admin checks pass if the proxy role is a tenant admin. A forwarded user can therefore perform admin or tenant administration operations they do not hold.","severity":"high","cvss":7.7,"epss":0.0039,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-pulsar","java","messaging","package","self-hosted"],"not_affected_if":["default-authorization-provider-only","no-proxy-in-front-of-broker","no-proxy-role-tenant-admin"],"how_to_check":"- Check whether the multi-role token authorization provider (MultiRolesTokenAuthorizationProvider) or a custom authorization provider using authentication data is configured on the broker.\n- Check whether any proxy role is listed as an admin role of a tenant, for example with `pulsar-admin tenants list` and `pulsar-admin tenants get <tenant>`.\n- Check the Pulsar version with `pulsar version`; versions from 2.8.1 before 4.0.14 and from 4.1.0 before 4.2.5 are affected.","fix":"- Upgrade Apache Pulsar to `4.0.14` on the 4.0.x line, or to `4.2.5` on the 4.1.x and 4.2.x lines, or to a newer release.\n- Remove proxy roles from tenant admin role lists until the upgrade is done.\n- Versions before 2.8.1 need an upgrade to a patched release, not a configuration change.","status":"open","published_at":"2026-10-21T19:16:57+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:10:29+00:00","updated_at":"2026-10-25T03:10:29+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:10:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Pulsar to `4.0.14` on the 4.0.x line, or to `4.2.5` on the 4.1.x and 4.2.x lines, or to a newer release.\n- Remove proxy roles from tenant admin role lists until the upgrade is done.\n- Versions before 2.8.1 need an upgrade to a patched release, not a configuration change.","reach":"network","title":"Apache Pulsar: proxy role lets forwarded users exceed their own permissions","impact":"high","summary":"When a Pulsar proxy forwards a user's request to the broker, the broker authorizes the user with the proxy's credentials instead of the user's own, and tenant admin checks pass if the proxy role is a tenant admin. A forwarded user can therefore perform admin or tenant administration operations they do not hold.","category":"package","nicknames":[],"who_cares":["apache-pulsar","self-hosted","messaging","java"],"confidence":0.8,"needs_auth":"yes","worst_case":"Forwarded users gain superuser or tenant admin operations they should not have","analyst_note":"","how_to_check":"- Check whether the multi-role token authorization provider (MultiRolesTokenAuthorizationProvider) or a custom authorization provider using authentication data is configured on the broker.\n- Check whether any proxy role is listed as an admin role of a tenant, for example with `pulsar-admin tenants list` and `pulsar-admin tenants get <tenant>`.\n- Check the Pulsar version with `pulsar version`; versions from 2.8.1 before 4.0.14 and from 4.1.0 before 4.2.5 are affected.","needs_analyst":false,"not_affected_if":["default-authorization-provider-only","no-proxy-role-tenant-admin","no-proxy-in-front-of-broker"],"who_is_affected":"Deployments that run a Pulsar proxy that forwards client requests to brokers are the exposed ones. The first flaw needs the multi-role token authorization provider or a custom provider that reads authentication data, with the proxy authenticating to the broker by token; the second needs a proxy role listed as a tenant admin, including with the default provider. Deployments using neither condition, and standalone brokers with no proxy, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000848,"input_tokens":4420,"output_tokens":811,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-105942':14A,17A '-2026':13A,16A '/contribute/release-policy/.':711C '2.10.1':417C '2.8':405C '2.8.1':241C,640C '2.8.4':402C '2.9':412C '2.9.3':409C '4.0':648C,697C '4.0.14':642C,657C '4.1':658C '4.1.0':645C '4.2':661C '4.2.5':647C,670C '5.0':700C 'add':237C 'admin':57B,67B,74B,159C,293C,337C,342C,359C,373C,479C,505C,513C,527C,541C,612C,629C 'administr':77B,392C 'affect':205C,225C,324C,441C,486C,635C 'aforement':683C 'allow':118C 'anoth':97C 'apach':1A,19B,239C,636C,692C 'apache-pulsar':18B 'api':161C,344C 'appli':170C,181C 'authent':151C,253C,261C,320C,437C,462C,569C,595C 'author':41B,107C,125C,146C,207C,221C,234C,274C,315C,333C,378C,428C,453C,520C,534C,554C,564C,577C 'avail':707C 'behalf':95C 'behavior':398C 'binari':178C 'broker':38B,40B,93C,103C,164C,194C,264C,465C 'built':518C 'built-in':517C 'cannot':131C 'check':58B,140C,338C,348C,514C,613C 'claim':247C 'client':189C 'configur':85C 'consid':523C 'could':322C,389C 'credenti':48B,191C 'current':690C 'custom':314C,432C,533C 'cve':12A,15A 'data':152C,254C,321C,438C,570C 'default':198C,220C,377C 'deploy':365C,419C,457C,469C 'design':105C 'differ':531C 'everi':172C 'exceed':8A,132C 'first':141C,444C 'fix':543C 'flaw':137C,228C,445C,490C 'forward':6A,31B,69B,187C,300C,385C,583C 'function':167C 'given':257C 'hold':82B,312C 'host':26B 'includ':374C 'independ':330C 'instead':49B,153C 'issu':634C 'java':21B 'least':656C,669C 'let':5A 'line':695C 'list':476C,501C,677C 'messag':22B 'multi':231C,425C,450C,574C 'multi-rol':230C,424C,449C,573C 'multirolestokenauthorizationprovid':236C 'must':621C 'name':215C,607C 'need':308C 'neither':422C,455C 'newer':687C 'onward':418C 'oper':78B,306C,393C,672C 'origin':100C,114C,129C,143C,270C,350C,551C,561C,589C,598C,603C,619C 'otherwis':600C 'packag':23B 'pass':59B 'patch':684C 'perform':73B,305C,390C 'permiss':11A,135C,211C,310C 'present':400C 'princip':101C,115C,130C,144C,271C,351C,552C,562C,590C,599C,604C,620C 'prior':674C 'protocol':179C 'provid':208C,222C,235C,316C,334C,379C,429C,433C,454C,521C,535C,578C 'proxi':3A,30B,46B,62B,86C,110C,149C,173C,184C,202C,260C,280C,303C,341C,354C,368C,388C,459C,473C,492C,547C,557C,615C 'pulsar':2A,20B,29B,177C,201C,240C,637C,693C 'pulsar.apache.org':710C 'pulsar.apache.org/contribute/release-policy/.':709C 'releas':407C,414C,694C 'request':35B,90C,120C,174C,298C,345C,383C,558C 'resolv':210C,242C 'rest':160C,343C 'role':4A,63B,87C,111C,214C,232C,243C,246C,277C,287C,294C,355C,360C,369C,426C,451C,474C,480C,493C,528C,548C,575C,580C,606C,616C 'schedul':705C 'second':329C,489C 'self':25B 'self-host':24B 'send':88C 'similar':327C 'succeed':346C 'superus':290C,497C,538C,625C 'support':691C,703C 'tenant':56B,66B,76B,292C,336C,363C,372C,391C,396C,483C,504C,512C,525C,540C,611C,628C,632C 'therefor':72B,273C 'token':233C,250C,268C,282C,427C,452C,468C,576C,584C,594C 'treat':537C 'trigger':508C 'two':136C 'upgrad':653C,666C,680C 'use':318C,421C,435C,586C,609C 'user':7A,33B,43B,52B,70B,98C,296C,381C,651C,664C,671C 'version':206C,544C,638C,650C,663C,673C,685C,688C,704C 'way':328C 'weaken':138C 'whose':297C,382C,458C 'without':311C,347C 'worker':168C 'x':406C,413C,649C,659C,662C,698C,701C","nicknames":[],"mitigations":[],"who_affected":"Deployments that run a Pulsar proxy that forwards client requests to brokers are the exposed ones. The first flaw needs the multi-role token authorization provider or a custom provider that reads authentication data, with the proxy authenticating to the broker by token; the second needs a proxy role listed as a tenant admin, including with the default provider. Deployments using neither condition, and standalone brokers with no proxy, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T19:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105942","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105942","severity":null,"published_at":"2026-10-21T19:16:57+00:00","modified_at":"2026-10-23T22:16:52+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-105942","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105942","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}