Is CVE-2026-105930 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105930 being exploited in the wild.

How severe is CVE-2026-105930?

Informational severity, published 21 October 2026.

Which products and versions are affected?

Apache Pulsar 2.8.0 through 4.0.13, 4.1.0 through 4.1.3, 4.2.0 through 4.2.4.

How is CVE-2026-105930 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-105930?

Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105930: Apache Pulsar package access control bypass in Functions worker

CVE-2026-105930 · Severity: info · Published 2026-10-21

Apache Pulsar is a distributed messaging platform. When package management is enabled, an authenticated user could register or update Pulsar Functions, Sources, or Sinks by supplying a package URL, allowing them to read package contents from other tenants they should not have access to. This could expose application code, business logic, or embedded credentials without granting the attacker modification or deletion capabilities.

Technologies: Apache Pulsar. Vendors: Apache.

Quick answers

Is CVE-2026-105930 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105930 being exploited in the wild.
How severe is CVE-2026-105930?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Apache Pulsar 2.8.0 through 4.0.13, 4.1.0 through 4.1.3, 4.2.0 through 4.2.4.
Is there a fix for CVE-2026-105930?: Yes: fixed in Pulsar 4.0.14, 4.2.5, and later. Until then: Ensure that authentication and authorization are enabled and verify that package management is disabled on the broker (enablePackagesManagement) and functions worker (functionsWorkerEnablePackageManagement) settings if the feature is not required.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105930 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-105930?: Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Pulsar 4.0.14, 4.2.5, and later

Ensure that authentication and authorization are enabled and verify that package management is disabled on the broker (enablePackagesManagement) and functions worker (functionsWorkerEnablePackageManagement) settings if the feature is not required.</anigation> </invoke>

Technical details

The Pulsar Functions worker fails to check whether a requesting user has permission to access packages in the namespace referenced by a package URL; instead, it retrieves the package using the worker's own credentials, causing the broker's permission checks to validate against the worker identity rather than the user's identity. This affects the package URL parameter and transform function URLs supplied during sink registration or updates. The vulnerability requires authentication, package management to be explicitly enabled on both broker and functions worker, and affects versions 2.8.0 through 4.0.13, 4.1.0 through 4.1.3, and 4.2.0 through 4.2.4.

Affected products

Apache Pulsar 2.8.0 through 4.0.13, 4.1.0 through 4.1.3, 4.2.0 through 4.2.4

Timeline

2026-10-21: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.