Is CVE-2026-105937 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105937 being exploited in the wild.

How severe is CVE-2026-105937?

Informational severity, published 21 October 2026.

Which products and versions are affected?

Apache Pulsar 3.0.0 to 4.0.13, 4.1.0 to 4.2.4.

How is CVE-2026-105937 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-105937?

Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105937: Apache Pulsar cross-tenant data access via shadow topics

CVE-2026-105937 · Severity: info · Published 2026-10-21

Apache Pulsar is a distributed message broker used for real-time data streaming. Shadow topics allow reading historical messages from another topic's storage. Due to insufficient authorization checks, a tenant admin can configure a shadow topic in their tenant to read retained messages from a topic in any other tenant, exposing cross-tenant data. Additionally, operations on shadow topics can permanently delete source topic messages across all tenants.

Technologies: Apache Pulsar. Vendors: Apache.

Quick answers

Is CVE-2026-105937 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105937 being exploited in the wild.
How severe is CVE-2026-105937?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Apache Pulsar 3.0.0 to 4.0.13, 4.1.0 to 4.2.4.
Is there a fix for CVE-2026-105937?: Yes: fixed in 4.0.14, 4.2.5. Until then: Restrict the tenant admin role only to trusted principals until upgrade is possible. After upgrading, shadow topics are disabled by default; deployments using shadow topics must explicitly set enableShadowTopics=true in broker configuration, and cross-tenant shadow topic binding requires the superuser role. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105937 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-105937?: Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.0.14, 4.2.5

Restrict the tenant admin role only to trusted principals until upgrade is possible. After upgrading, shadow topics are disabled by default; deployments using shadow topics must explicitly set enableShadowTopics=true in broker configuration, and cross-tenant shadow topic binding requires the superuser role.

Technical details

The broker authorizes shadow topic creation and the PULSAR.SHADOW_SOURCE property against only the topic being created, not the source topic in the property. An authenticated user with tenant admin privileges can bind a shadow topic to any accessible persistent topic in other tenants and consume retained messages without source topic permissions. The vulnerability also allows shadow topic operations to delete or trim source topic ledgers and tiered storage data, causing permanent message loss regardless of retention policies or subscriptions.

Affected products

Apache Pulsar 3.0.0 to 4.0.13, 4.1.0 to 4.2.4

Timeline

2026-10-21: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.