# CVE-2026-105933: Apache Pulsar encryption requirement bypass in topic initialization

Source: https://junglewise.ai/threats/cve-2026-105933-apache-pulsar-allows-an-administrator-to-require-end-to-end  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-105933 · Severity: info · Published 2026-10-21

Apache Pulsar is a distributed messaging system used for real-time data streaming. An administrator can require end-to-end encryption for all messages in a namespace, but if the broker encounters errors while loading a topic—such as metadata store failures—it silently disables the encryption requirement and allows unencrypted messages to be published and stored. This can persist indefinitely until the underlying error is resolved, defeating the encryption policy despite successful topic loading.

Technologies: [Apache Pulsar](https://junglewise.ai/threats/technologies/pulsar). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-105933 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105933 being exploited in the wild.

**How severe is CVE-2026-105933?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Apache Pulsar 1.22.0-incubating through 4.0.13; 4.1.0 through 4.2.4.

**Is there a fix for CVE-2026-105933?** Yes: fixed in 4.0.14, 4.2.5. Until then: Monitor broker logs for warnings containing "isEncryptionRequired will be set to false", identify and resolve the underlying initialization failure, then reload the affected topic to confirm enforcement is restored. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105933 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-105933?** Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.0.14, 4.2.5

Monitor broker logs for warnings containing "isEncryptionRequired will be set to false", identify and resolve the underlying initialization failure, then reload the affected topic to confirm enforcement is restored.

## Technical details

A failure during persistent topic initialization (caused by metadata store errors, topic-level policy loading failures, or other initialization steps) causes the broker to log a warning, disable encryption_required enforcement, and complete the load as successful rather than failing the load. An authenticated producer with publish permission can then send unencrypted messages that are accepted and stored. The condition persists across topic unloads and reassignments until the root cause is resolved; topic statistics do not reflect the disabled enforcement state.

## Affected products

- Apache Pulsar 1.22.0-incubating through 4.0.13; 4.1.0 through 4.2.4

## Timeline

- 2026-10-21: disclosed
- 2026-10-21: patched

## Related threats

- [Apache Pulsar path traversal in package management filesystem storage](https://junglewise.ai/threats/cve-2026-105945-the-pulsar-packages-management-service-can-be-configured-to)
- [Apache Pulsar proxy authorization bypass in multi-role token provider](https://junglewise.ai/threats/cve-2026-105942-when-a-configured-proxy-role-sends-a-request-to-the-broker-on)
- [Apache Pulsar subscription policy bypass in admin REST API](https://junglewise.ai/threats/cve-2026-105938-apache-pulsar-namespaces-can-restrict-which-roles-may-use-a)
- [Apache Pulsar cross-tenant data access via shadow topics](https://junglewise.ai/threats/cve-2026-105937-apache-pulsar-shadow-topics-pip-180-are-topics-that-read-the)
- [Apache Pulsar Functions worker REST API improper access control](https://junglewise.ai/threats/cve-2026-105936-the-pulsar-functions-worker-rest-api-provides-two-endpoints-that)