# CVE-2026-105931: Apache Pulsar transaction REST API information disclosure

Source: https://junglewise.ai/threats/cve-2026-105931-the-apache-pulsar-broker-exposes-a-transaction-administration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-105931 · Severity: info · Published 2026-10-21

Apache Pulsar is an open-source message broker used for distributed event streaming. The transaction administration REST API fails to properly verify that authenticated users have permission to access tenant, namespace, or topic data, allowing any authenticated user to read transaction metadata and statistics belonging to other tenants. This can reveal which topics are involved in transactions, subscription details, and coordinator locations, but does not allow reading message contents or modifying transactions.

Technologies: [Apache Pulsar](https://junglewise.ai/threats/technologies/pulsar). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-105931 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105931 being exploited in the wild.

**How severe is CVE-2026-105931?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Apache Pulsar 2.8.0 to 4.0.13; 4.1.0 to 4.2.4.

**Is there a fix for CVE-2026-105931?** Yes: fixed in 4.0.14, 4.2.5. Until then: If Pulsar transactions are not required, disable transaction support (transactionCoordinatorEnabled). When transactions are in use, restrict network access to the broker's admin HTTP endpoints to trusted administrative clients only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105931 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-105931?** Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.0.14, 4.2.5

If Pulsar transactions are not required, disable transaction support (transactionCoordinatorEnabled). When transactions are in use, restrict network access to the broker's admin HTTP endpoints to trusted administrative clients only.

## Technical details

The /admin/v3/transactions REST API endpoints verify authentication but fail to enforce authorization checks on read operations across tenant boundaries. An authenticated user with no specific permissions can call these endpoints to enumerate transaction coordinators, retrieve transaction metadata (including topic and subscription names), view coordinator statistics, and discover whether topics exist in other tenants. The vulnerability only discloses transaction-related metadata; message content and transaction state modifications are not affected.

## Affected products

- Apache Pulsar 2.8.0 to 4.0.13; 4.1.0 to 4.2.4

## Timeline

- 2026-10-21: disclosed

## Related threats

- [Apache Pulsar path traversal in package management filesystem storage](https://junglewise.ai/threats/cve-2026-105945-the-pulsar-packages-management-service-can-be-configured-to)
- [Apache Pulsar proxy authorization bypass in multi-role token provider](https://junglewise.ai/threats/cve-2026-105942-when-a-configured-proxy-role-sends-a-request-to-the-broker-on)
- [Apache Pulsar subscription policy bypass in admin REST API](https://junglewise.ai/threats/cve-2026-105938-apache-pulsar-namespaces-can-restrict-which-roles-may-use-a)
- [Apache Pulsar cross-tenant data access via shadow topics](https://junglewise.ai/threats/cve-2026-105937-apache-pulsar-shadow-topics-pip-180-are-topics-that-read-the)
- [Apache Pulsar Functions worker REST API improper access control](https://junglewise.ai/threats/cve-2026-105936-the-pulsar-functions-worker-rest-api-provides-two-endpoints-that)