# CVE-2026-105932: Apache Pulsar authorization bypass in non-persistent topic entry filters

Source: https://junglewise.ai/threats/cve-2026-105932-the-apache-pulsar-broker-admin-rest-api-provides-endpoints-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-105932 · Severity: info · Published 2026-10-21

Apache Pulsar is a distributed messaging platform used for real-time data streaming across applications. An authorization flaw in the admin REST API allows authenticated users with produce or consume permissions to manage entry filter policies on non-persistent topics, even if they lack policy management rights. The practical impact is limited: it requires operators to have installed custom entry filters and enabled topic-level policy overrides (both disabled by default), but affected deployments could have message filtering policies unexpectedly modified or removed.

Technologies: [Apache Pulsar](https://junglewise.ai/threats/technologies/pulsar). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-105932 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105932 being exploited in the wild.

**How severe is CVE-2026-105932?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Apache Pulsar 3.3.0 before 4.0.14, 4.1.0 before 4.2.5.

**Is there a fix for CVE-2026-105932?** Yes: fixed in Pulsar 4.0.14, 4.2.5. Until then: Keep the broker configuration option allowOverrideEntryFilters at its default value of false, so that topic-level entry filter policies do not affect message dispatch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105932 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-105932?** Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Pulsar 4.0.14, 4.2.5

Keep the broker configuration option allowOverrideEntryFilters at its default value of false, so that topic-level entry filter policies do not affect message dispatch.

## Technical details

The non-persistent topic entry filter endpoints (/admin/v2/non-persistent/{tenant}/{namespace}/{topic}/entryFilters) perform only an indirect topic lookup permission check but skip the explicit authorization check for the entry filters policy operation that is present in the persistent topic endpoints. An authenticated user with produce or consume permission on a non-persistent topic can read, replace, or remove its topic-level entry filter policy without tenant admin or superuser role. The attack is network-based, requires authentication and produce/consume permission, and only affects deployments with installed entry filters and allowOverrideEntryFilters enabled (both non-default).

## Affected products

- Apache Pulsar 3.3.0 before 4.0.14, 4.1.0 before 4.2.5

## Timeline

- 2026-10-21: disclosed

## Related threats

- [Apache Pulsar path traversal in package management filesystem storage](https://junglewise.ai/threats/cve-2026-105945-the-pulsar-packages-management-service-can-be-configured-to)
- [Apache Pulsar proxy authorization bypass in multi-role token provider](https://junglewise.ai/threats/cve-2026-105942-when-a-configured-proxy-role-sends-a-request-to-the-broker-on)
- [Apache Pulsar subscription policy bypass in admin REST API](https://junglewise.ai/threats/cve-2026-105938-apache-pulsar-namespaces-can-restrict-which-roles-may-use-a)
- [Apache Pulsar cross-tenant data access via shadow topics](https://junglewise.ai/threats/cve-2026-105937-apache-pulsar-shadow-topics-pip-180-are-topics-that-read-the)
- [Apache Pulsar Functions worker REST API improper access control](https://junglewise.ai/threats/cve-2026-105936-the-pulsar-functions-worker-rest-api-provides-two-endpoints-that)