Is CVE-2026-105869 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105869 being exploited in the wild.

How severe is CVE-2026-105869?

Informational severity, published 21 October 2026.

Which products and versions are affected?

Apache Pulsar 2.8.1 before 4.0.14; 4.1.0 before 4.2.5.

How is CVE-2026-105869 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-105869?

Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105869: Apache Pulsar MultiRolesTokenAuthorizationProvider privilege escalation

CVE-2026-105869 · Severity: info · Published 2026-10-21

Apache Pulsar is a distributed messaging platform used for real-time data streaming. The MultiRolesTokenAuthorizationProvider can be bypassed to grant unauthenticated clients arbitrary roles, including super-user access, allowing attackers to read and modify tenants, namespaces, topics, and broker configuration without valid credentials.

Technologies: Apache Pulsar. Vendors: Apache.

Quick answers

Is CVE-2026-105869 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105869 being exploited in the wild.
How severe is CVE-2026-105869?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Apache Pulsar 2.8.1 before 4.0.14; 4.1.0 before 4.2.5.
Is there a fix for CVE-2026-105869?: Yes: fixed in 4.0.14, 4.2.5. Until then: Remove the anonymousUserRole setting from broker and WebSocket service configurations, or restrict network access to HTTP endpoints to trusted clients. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105869 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-105869?: Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.0.14, 4.2.5

Remove the anonymousUserRole setting from broker and WebSocket service configurations, or restrict network access to HTTP endpoints to trusted clients.

Technical details

The MultiRolesTokenAuthorizationProvider authorizes clients based on roles in JWT claims without verifying the token's signature. When authentication fails on HTTP endpoints (admin REST API, WebSocket) with a non-empty anonymousUserRole setting, the unverified Authorization header is parsed and roles are extracted, allowing forged or unsigned tokens to grant arbitrary privileges. Fixed versions obtain roles only from tokens verified by the configured token authentication provider and deny additional roles to anonymous user fallbacks.

Affected products

Apache Pulsar 2.8.1 before 4.0.14; 4.1.0 before 4.2.5

Timeline

2026-10-21: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.