{"id":"CVE-2026-105944","kind":"vulnerability","aliases":["CVE-2026-105944"],"related":[],"title":"Apache Pulsar Manager: unauthenticated takeover and leaked cluster admin credential","description":"Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the following security issues:\n\n- The operation for creating the initial administrator (superuser) account is available without authentication, and it remains available after the instance has been initialized. Anyone who can reach Pulsar Manager can create an additional administrator account at any time and log in with it. This issue affects versions 0.3.0 and later.\n- Requests to the Pulsar admin API that Pulsar Manager proxies to the configured Pulsar cluster are not subject to Pulsar Manager's authentication. Version 0.2.0 checks the caller's permissions for some of these requests, but not for all of them. An unauthenticated user can therefore use Pulsar Manager to send requests to the Pulsar admin API, which the cluster processes with the credential configured in Pulsar Manager.\n- The destination of a proxied request can be chosen by the requester, and Pulsar Manager attaches its configured Pulsar admin credential to the request. An unauthenticated user can make Pulsar Manager send this credential to a host of the user's choosing, and the credential can then be used directly against the Pulsar cluster.\n- In versions 0.3.0 and later, Pulsar Manager does not distinguish between privilege levels of its accounts. Every account, including one created through the first issue, effectively has full administrative privileges in Pulsar Manager.\n\nThe impact depends on the version and the deployment. In versions 0.3.0 and later, any user who can reach Pulsar Manager over the network can take full control of Pulsar Manager. In all versions, when Pulsar Manager is configured with an HTTP authentication credential for a Pulsar cluster, any user who can reach Pulsar Manager can perform the Pulsar admin operations that this credential permits and can obtain the credential itself. When Pulsar Manager is configured with the token signing key of a Pulsar cluster, an administrator of Pulsar Manager can create tokens for the cluster.\n\nApache Pulsar Manager is no longer maintained and is completely unsupported. The Apache Pulsar PMC has retired it. There are no supported versions, and no further releases, fixes or security updates will be made for any version. These issues will not be fixed.\n\nUsing Pulsar Manager is not recommended. Users should stop using Pulsar Manager, remove existing deployments, and move to one of the alternatives described in the Administration UI documentation (https://pulsar.apache.org/docs/administration-ui). Users who have exposed Pulsar Manager configured with a Pulsar credential or token signing key should also consider replacing that credential or key.\n\nUntil a deployment is removed, users should not expose Pulsar Manager to untrusted networks, and should restrict network access to it to trusted administrators.","summary":"Apache Pulsar Manager, a web console for Pulsar clusters, lets anyone who can reach it create an admin account without logging in. Unauthenticated users can also make it send its configured Pulsar admin token to a host they choose and proxy admin API calls to the cluster.","severity":"critical","cvss":10.0,"epss":0.00703,"exploited":false,"exploited_at":null,"products":[{"name":"pulsar-manager","fixed":[],"affected":">= 0.1.0, <= 0.4.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["apache-pulsar","end-of-life","kubernetes","package","pulsar-manager","self-hosted"],"not_affected_if":["network-restricted-to-trusted-admins","pulsar-manager-not-deployed"],"how_to_check":"Find Pulsar Manager deployments: it is a Spring Boot app, default port 9527 (frontend) / 7750 (backend). Check for the apachepulsar/pulsar-manager container image (docker ps, kubectl get pods -A, grep image names), or for pulsar_manager.enabled=true in Helm values (disabled by default in current Apache Pulsar Helm chart). Any version 0.1.0-0.4.0 is affected. Then test reachability from untrusted networks.","fix":"No fix will be released. Remove Pulsar Manager and move to an alternative from https://pulsar.apache.org/docs/administration-ui. Until removed, restrict network access to trusted admins only. If it was ever exposed and configured with a Pulsar token or token signing key, rotate that token/key, and review it for rogue admin accounts.","status":"resolved","published_at":"2026-10-21T19:16:57+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-23T22:32:58+00:00","updated_at":"2026-10-24T13:15:54+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:32:58Z","model":"claude-haiku-5-5","output":{"fix":"No fixed version exists: the project is retired and unsupported, so remove the Pulsar Manager deployment and move to an alternative from https://pulsar.apache.org/docs/administration-ui. Also rotate any Pulsar token or token signing key configured in Pulsar Manager.","reach":"network","title":"Apache Pulsar Manager: unauthenticated takeover and leaked cluster admin credential","impact":"high","summary":"Apache Pulsar Manager, a web console for Pulsar clusters, lets anyone who can reach it create an admin account without logging in. Unauthenticated users can also make it send its configured Pulsar admin token to a host they choose and proxy admin API calls to the cluster.","category":"package","who_cares":["apache-pulsar","pulsar-manager","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker gains full console control and steals the cluster admin token","analyst_note":"Confirm the affected version range (0.2.0 and 0.3.0+ per the text) and check whether any deployments remain in the wild; sources give no how-to-check command.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["pulsar-manager-not-deployed","network-restricted-to-trusted-admins"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.00062,"input_tokens":3800,"output_tokens":479,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected version range (0.2.0 and 0.3.0+ per the text) and check whether any deployments remain in the wild; sources give no how-to-check command.","search":"'-105944':13A,16A '-2026':12A,15A '/docs/administration-ui).':511C '0.2.0':211C '0.3.0':184C,311C,353C 'access':553C 'account':53B,99C,145C,171C,324C,326C 'addit':169C 'admin':9A,52B,67B,76B,123C,191C,242C,274C,401C 'administ':90C 'administr':143C,170C,337C,428C,506C,558C 'affect':182C 'also':60B,528C 'altern':502C 'anyon':45B,160C 'apach':1A,21B,35B,82C,91C,438C,450C 'apache-pulsar':20B 'api':77B,124C,192C,243C 'attach':270C 'authent':110C,149C,209C,384C 'avail':147C,153C 'behalf':126C 'call':78B,120C 'caller':214C 'check':212C 'choos':73B,296C 'chosen':263C 'cluster':8A,43B,81B,93C,201C,246C,308C,389C,426C,437C 'complet':447C 'configur':65B,106C,199C,251C,272C,380C,417C,518C 'consid':529C 'consol':40B,88C 'control':369C 'creat':50B,140C,167C,329C,433C 'credenti':10A,111C,250C,275C,288C,299C,385C,405C,411C,522C,532C 'cve':11A,14A 'depend':344C 'deploy':350C,495C,537C 'describ':503C 'destin':256C 'direct':304C 'distinguish':318C 'document':508C 'effect':334C 'end':24B 'end-of-lif':23B 'everi':325C 'exist':494C 'expos':515C,543C 'first':332C 'fix':465C,480C 'follow':134C 'full':336C,368C 'host':34B,71B,291C 'http':109C,383C 'impact':343C 'includ':327C 'initi':142C,159C 'instanc':156C 'issu':136C,181C,333C,476C 'key':422C,526C,534C 'kubernet':27B 'later':186C,313C,355C 'leak':7A 'let':44B 'level':321C 'life':26B 'log':55B,176C 'login':101C 'longer':443C 'made':471C 'maintain':444C 'make':61B,283C 'manag':3A,31B,37B,84C,131C,165C,195C,207C,235C,254C,269C,285C,315C,341C,362C,372C,378C,396C,415C,431C,440C,483C,492C,517C,545C 'manager':19A 'move':497C 'network':365C,548C,552C 'obtain':409C 'one':328C,499C 'oper':138C,402C 'packag':28B 'perform':398C 'permiss':216C 'permit':406C 'pmc':452C 'privileg':320C,338C 'process':247C 'proxi':75B,196C,259C 'pulsar':2A,18A,22B,30B,36B,42B,66B,83C,92C,122C,130C,164C,190C,194C,200C,206C,234C,241C,253C,268C,273C,284C,307C,314C,340C,361C,371C,377C,388C,395C,400C,414C,425C,430C,439C,451C,482C,491C,516C,521C,544C 'pulsar-manag':29B 'pulsar-manager':17A 'pulsar.apache.org':510C 'pulsar.apache.org/docs/administration-ui).':509C 'reach':48B,163C,360C,394C 'recommend':486C 'releas':464C 'remain':152C 'remov':493C,539C 'replac':530C 'request':187C,221C,238C,260C,266C,278C 'restrict':551C 'retir':454C 'secur':135C,467C 'self':33B 'self-host':32B 'send':63B,237C,286C 'sign':421C,525C 'stop':489C 'subject':204C 'superus':144C 'support':459C 'take':367C 'takeov':5A 'therefor':232C 'time':174C 'token':68B,115C,420C,434C,524C 'trust':557C 'ui':507C 'unauthent':4A,57B,229C,280C 'unsupport':448C 'untrust':547C 'updat':468C 'use':118C,233C,303C,481C,490C 'user':58B,98C,129C,230C,281C,294C,357C,391C,487C,512C,540C 'version':183C,210C,310C,347C,352C,375C,460C,474C 'web':39B,87C 'without':54B,148C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T19:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105944","severity":null,"published_at":"2026-10-21T19:16:57+00:00","modified_at":"2026-10-23T22:16:52+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105944:309","url":null,"severity":null,"published_at":"2026-10-23T22:50:40+00:00","modified_at":"2026-10-23T22:50:40+00:00","first_seen_at":"2026-10-23T22:50:40+00:00","fetched_at":"2026-10-23T22:50:40+00:00","note":"Read Apache's own advisory (pulsar.apache.org/security) and oss-security post: affected is ALL releases 0.1.0-0.4.0 (last), no fix, project retired. Corrects triage range. No PoC or exploitation reported; X chatter not pulled."},{"source":"epss","external_id":"CVE-2026-105944","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-105944","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[{"id":1626,"url":"https://pulsar.apache.org/security/CVE-2026-105944/","title":"Apache Pulsar security advisory CVE-2026-105944","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1627,"url":"https://apache.googlesource.com/pulsar-manager/+/refs/heads/master","title":"pulsar-manager README: no longer maintained","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":1628,"url":"https://www.openwall.com/lists/oss-security/2026/10/21/26","title":"oss-security: Pulsar Manager CVE-2026-105944","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}