Is CVE-2026-105931 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105931 being exploited in the wild.

How severe is CVE-2026-105931?

Informational severity, published 21 October 2026.

Which products and versions are affected?

Apache Pulsar 2.8.0 to 4.0.13; 4.1.0 to 4.2.4.

How is CVE-2026-105931 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-105931?

Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105931: Apache Pulsar transaction REST API information disclosure

CVE-2026-105931 · Severity: info · Published 2026-10-21

Apache Pulsar is an open-source message broker used for distributed event streaming. The transaction administration REST API fails to properly verify that authenticated users have permission to access tenant, namespace, or topic data, allowing any authenticated user to read transaction metadata and statistics belonging to other tenants. This can reveal which topics are involved in transactions, subscription details, and coordinator locations, but does not allow reading message contents or modifying transactions.

Technologies: Apache Pulsar. Vendors: Apache.

Quick answers

Is CVE-2026-105931 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105931 being exploited in the wild.
How severe is CVE-2026-105931?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Apache Pulsar 2.8.0 to 4.0.13; 4.1.0 to 4.2.4.
Is there a fix for CVE-2026-105931?: Yes: fixed in 4.0.14, 4.2.5. Until then: If Pulsar transactions are not required, disable transaction support (transactionCoordinatorEnabled). When transactions are in use, restrict network access to the broker's admin HTTP endpoints to trusted administrative clients only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105931 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-105931?: Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.0.14, 4.2.5

If Pulsar transactions are not required, disable transaction support (transactionCoordinatorEnabled). When transactions are in use, restrict network access to the broker's admin HTTP endpoints to trusted administrative clients only.

Technical details

The /admin/v3/transactions REST API endpoints verify authentication but fail to enforce authorization checks on read operations across tenant boundaries. An authenticated user with no specific permissions can call these endpoints to enumerate transaction coordinators, retrieve transaction metadata (including topic and subscription names), view coordinator statistics, and discover whether topics exist in other tenants. The vulnerability only discloses transaction-related metadata; message content and transaction state modifications are not affected.

Affected products

Apache Pulsar 2.8.0 to 4.0.13; 4.1.0 to 4.2.4

Timeline

2026-10-21: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.