Is CVE-2026-105936 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105936 being exploited in the wild.

How severe is CVE-2026-105936?

Informational severity, published 21 October 2026.

Which products and versions are affected?

Apache Pulsar 2.4.1 to 4.0.13, 4.1.0 to 4.2.4.

How is CVE-2026-105936 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-105936?

Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105936: Apache Pulsar Functions worker REST API improper access control

CVE-2026-105936 · Severity: info · Published 2026-10-21

Apache Pulsar is a distributed messaging system used for data streaming and event processing. A vulnerability in the Pulsar Functions worker REST API allows authenticated users without super-user access to view the catalog of installed IO connectors, bypassing intended authorization controls. This disclosure reveals metadata such as connector names and descriptions, but does not expose actual connector configurations, credentials, or allow modification of connectors.

Technologies: Apache Pulsar. Vendors: Apache.

Quick answers

Is CVE-2026-105936 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105936 being exploited in the wild.
How severe is CVE-2026-105936?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Apache Pulsar 2.4.1 to 4.0.13, 4.1.0 to 4.2.4.
Is there a fix for CVE-2026-105936?: Yes: fixed in Pulsar 4.0.14, 4.2.5, or later. Until then: Upgrade to Pulsar 4.0.14 (for 4.0.x users) or 4.2.5 or later (for 4.1.x and 4.2.x users). Alternatively, restrict network access to Functions worker REST API endpoints and ensure only authorized clients can authenticate to the Pulsar cluster. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105936 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-105936?: Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Pulsar 4.0.14, 4.2.5, or later

Upgrade to Pulsar 4.0.14 (for 4.0.x users) or 4.2.5 or later (for 4.1.x and 4.2.x users). Alternatively, restrict network access to Functions worker REST API endpoints and ensure only authorized clients can authenticate to the Pulsar cluster.

Technical details

The Functions worker REST API endpoints (/admin/v2/functions/connectors and /admin/v3/functions/connectors) fail to enforce super-user access checks required by authorization policy, unlike the worker connectors endpoint (/admin/v2/worker/connectors). Any authenticated client can enumerate installed connector types and their metadata through these endpoints. The vulnerability affects Pulsar versions 2.4.1 through 4.0.13 and 4.1.0 through 4.2.4, when authentication and authorization are enabled.

Affected products

Apache Pulsar 2.4.1 to 4.0.13, 4.1.0 to 4.2.4

Timeline

2026-10-21: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.