# CVE-2026-105936: Apache Pulsar Functions worker REST API improper access control

Source: https://junglewise.ai/threats/cve-2026-105936-the-pulsar-functions-worker-rest-api-provides-two-endpoints-that  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-105936 · Severity: info · Published 2026-10-21

Apache Pulsar is a distributed messaging system used for data streaming and event processing. A vulnerability in the Pulsar Functions worker REST API allows authenticated users without super-user access to view the catalog of installed IO connectors, bypassing intended authorization controls. This disclosure reveals metadata such as connector names and descriptions, but does not expose actual connector configurations, credentials, or allow modification of connectors.

Technologies: [Apache Pulsar](https://junglewise.ai/threats/technologies/pulsar). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-105936 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105936 being exploited in the wild.

**How severe is CVE-2026-105936?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Apache Pulsar 2.4.1 to 4.0.13, 4.1.0 to 4.2.4.

**Is there a fix for CVE-2026-105936?** Yes: fixed in Pulsar 4.0.14, 4.2.5, or later. Until then: Upgrade to Pulsar 4.0.14 (for 4.0.x users) or 4.2.5 or later (for 4.1.x and 4.2.x users). Alternatively, restrict network access to Functions worker REST API endpoints and ensure only authorized clients can authenticate to the Pulsar cluster. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105936 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-105936?** Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Pulsar 4.0.14, 4.2.5, or later

Upgrade to Pulsar 4.0.14 (for 4.0.x users) or 4.2.5 or later (for 4.1.x and 4.2.x users). Alternatively, restrict network access to Functions worker REST API endpoints and ensure only authorized clients can authenticate to the Pulsar cluster.

## Technical details

The Functions worker REST API endpoints (/admin/v2/functions/connectors and /admin/v3/functions/connectors) fail to enforce super-user access checks required by authorization policy, unlike the worker connectors endpoint (/admin/v2/worker/connectors). Any authenticated client can enumerate installed connector types and their metadata through these endpoints. The vulnerability affects Pulsar versions 2.4.1 through 4.0.13 and 4.1.0 through 4.2.4, when authentication and authorization are enabled.

## Affected products

- Apache Pulsar 2.4.1 to 4.0.13, 4.1.0 to 4.2.4

## Timeline

- 2026-10-21: disclosed

## Related threats

- [Apache Pulsar path traversal in package management filesystem storage](https://junglewise.ai/threats/cve-2026-105945-the-pulsar-packages-management-service-can-be-configured-to)
- [Apache Pulsar proxy authorization bypass in multi-role token provider](https://junglewise.ai/threats/cve-2026-105942-when-a-configured-proxy-role-sends-a-request-to-the-broker-on)
- [Apache Pulsar subscription policy bypass in admin REST API](https://junglewise.ai/threats/cve-2026-105938-apache-pulsar-namespaces-can-restrict-which-roles-may-use-a)
- [Apache Pulsar cross-tenant data access via shadow topics](https://junglewise.ai/threats/cve-2026-105937-apache-pulsar-shadow-topics-pip-180-are-topics-that-read-the)
- [Apache Pulsar Functions Worker authorization bypass in trigger endpoint](https://junglewise.ai/threats/cve-2026-105935-the-pulsar-functions-worker-provides-a-rest-api-endpoint-for)