# CVE-2026-105934: Apache Pulsar authorization bypass in partitioned topic truncate

Source: https://junglewise.ai/threats/cve-2026-105934-the-apache-pulsar-broker-admin-rest-api-provides-a-truncate  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-105934 · Severity: info · Published 2026-10-21

Apache Pulsar is a distributed messaging system used to stream data across applications and services. An authenticated user without administrative privileges can truncate partitioned topics they can access, skipping unacknowledged messages and permanently deleting older message ledgers, causing data loss. This requires the broker's internal identity to have administrative privileges for the tenant, which is typical in production deployments with authorization enabled.

Technologies: [Apache Pulsar](https://junglewise.ai/threats/technologies/pulsar). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-105934 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105934 being exploited in the wild.

**How severe is CVE-2026-105934?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Apache Pulsar 2.8.0 before 4.0.14, 4.1.0 before 4.2.5.

**Is there a fix for CVE-2026-105934?** Yes: fixed in Pulsar 4.0.14, 4.2.5. Until then: Restrict network access to the broker's admin REST API (/admin/v2) to trusted administrative clients only until you can upgrade. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105934 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-105934?** Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Pulsar 4.0.14, 4.2.5

Restrict network access to the broker's admin REST API (/admin/v2) to trusted administrative clients only until you can upgrade.

## Technical details

The truncate operation on partitioned topics in the admin REST API fails to validate that the caller has tenant admin or superuser role, instead delegating per-partition truncate requests through the broker's internal admin client. An authenticated user with lookup permission on a partitioned topic can truncate it if the broker's identity has the required administrative role, bypassing caller authorization checks. This moves subscription cursors to the end and deletes inactive ledgers, resulting in unacknowledged message loss and potential permanent deletion of retained messages.

## Affected products

- Apache Pulsar 2.8.0 before 4.0.14, 4.1.0 before 4.2.5

## Timeline

- 2026-10-21: disclosed

## Related threats

- [Apache Pulsar path traversal in package management filesystem storage](https://junglewise.ai/threats/cve-2026-105945-the-pulsar-packages-management-service-can-be-configured-to)
- [Apache Pulsar proxy authorization bypass in multi-role token provider](https://junglewise.ai/threats/cve-2026-105942-when-a-configured-proxy-role-sends-a-request-to-the-broker-on)
- [Apache Pulsar subscription policy bypass in admin REST API](https://junglewise.ai/threats/cve-2026-105938-apache-pulsar-namespaces-can-restrict-which-roles-may-use-a)
- [Apache Pulsar cross-tenant data access via shadow topics](https://junglewise.ai/threats/cve-2026-105937-apache-pulsar-shadow-topics-pip-180-are-topics-that-read-the)
- [Apache Pulsar Functions worker REST API improper access control](https://junglewise.ai/threats/cve-2026-105936-the-pulsar-functions-worker-rest-api-provides-two-endpoints-that)