Is CVE-2026-105933 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105933 being exploited in the wild.

How severe is CVE-2026-105933?

Informational severity, published 21 October 2026.

Which products and versions are affected?

Apache Pulsar 1.22.0-incubating through 4.0.13; 4.1.0 through 4.2.4.

How is CVE-2026-105933 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-105933?

Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105933: Apache Pulsar encryption requirement bypass in topic initialization

CVE-2026-105933 · Severity: info · Published 2026-10-21

Apache Pulsar is a distributed messaging system used for real-time data streaming. An administrator can require end-to-end encryption for all messages in a namespace, but if the broker encounters errors while loading a topic—such as metadata store failures—it silently disables the encryption requirement and allows unencrypted messages to be published and stored. This can persist indefinitely until the underlying error is resolved, defeating the encryption policy despite successful topic loading.

Technologies: Apache Pulsar. Vendors: Apache.

Quick answers

Is CVE-2026-105933 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105933 being exploited in the wild.
How severe is CVE-2026-105933?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Apache Pulsar 1.22.0-incubating through 4.0.13; 4.1.0 through 4.2.4.
Is there a fix for CVE-2026-105933?: Yes: fixed in 4.0.14, 4.2.5. Until then: Monitor broker logs for warnings containing "isEncryptionRequired will be set to false", identify and resolve the underlying initialization failure, then reload the affected topic to confirm enforcement is restored. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105933 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-105933?: Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.0.14, 4.2.5

Monitor broker logs for warnings containing "isEncryptionRequired will be set to false", identify and resolve the underlying initialization failure, then reload the affected topic to confirm enforcement is restored.

Technical details

A failure during persistent topic initialization (caused by metadata store errors, topic-level policy loading failures, or other initialization steps) causes the broker to log a warning, disable encryption_required enforcement, and complete the load as successful rather than failing the load. An authenticated producer with publish permission can then send unencrypted messages that are accepted and stored. The condition persists across topic unloads and reassignments until the root cause is resolved; topic statistics do not reflect the disabled enforcement state.

Affected products

Apache Pulsar 1.22.0-incubating through 4.0.13; 4.1.0 through 4.2.4

Timeline

2026-10-21: disclosed
2026-10-21: patched

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.