# CVE-2026-105938: Apache Pulsar subscription policy bypass in admin REST API

Source: https://junglewise.ai/threats/cve-2026-105938-apache-pulsar-namespaces-can-restrict-which-roles-may-use-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-105938 · Severity: info · Published 2026-10-21

Apache Pulsar is a distributed messaging system used for event streaming and real-time data processing. Certain admin REST API operations that manage subscriptions fail to enforce namespace-level subscription access policies, allowing an authenticated user with basic consume permission to clear backlogs, expire messages, or delete subscriptions they should not have access to. This could result in loss of undelivered messages and disruption of message routing, though message contents cannot be read and permissions cannot be modified.

Technologies: [Apache Pulsar](https://junglewise.ai/threats/technologies/pulsar). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-105938 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105938 being exploited in the wild.

**How severe is CVE-2026-105938?** Informational severity, published 21 October 2026.

**Which products and versions are affected?** Apache Pulsar 2.8.0 to 4.0.13, 4.1.0 to 4.2.4.

**Is there a fix for CVE-2026-105938?** Yes: fixed in 4.0.14, 4.2.5. Until then: Restrict network access to the broker's admin REST API to trusted administrative clients only until the upgrade can be applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105938 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-105938?** Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.0.14, 4.2.5

Restrict network access to the broker's admin REST API to trusted administrative clients only until the upgrade can be applied.

## Technical details

The vulnerability is an authorization bypass in namespace-level and bundle-level admin REST API operations (clear backlog, unsubscribe, expire messages) that do not apply subscription access policies enforced by Prefix subscription authentication mode or role-based subscription permissions. An authenticated user with namespace or topic consume permission can bypass these subscription-level policies. The issue affects versions 2.8.0 through 4.0.13 and 4.1.0 through 4.2.4; fixed versions enforce subscription policies on all operations and restrict bulk operations to subscriptions the user may access.

## Affected products

- Apache Pulsar 2.8.0 to 4.0.13, 4.1.0 to 4.2.4

## Timeline

- 2026-10-21: disclosed

## Related threats

- [Apache Pulsar path traversal in package management filesystem storage](https://junglewise.ai/threats/cve-2026-105945-the-pulsar-packages-management-service-can-be-configured-to)
- [Apache Pulsar proxy authorization bypass in multi-role token provider](https://junglewise.ai/threats/cve-2026-105942-when-a-configured-proxy-role-sends-a-request-to-the-broker-on)
- [Apache Pulsar cross-tenant data access via shadow topics](https://junglewise.ai/threats/cve-2026-105937-apache-pulsar-shadow-topics-pip-180-are-topics-that-read-the)
- [Apache Pulsar Functions worker REST API improper access control](https://junglewise.ai/threats/cve-2026-105936-the-pulsar-functions-worker-rest-api-provides-two-endpoints-that)
- [Apache Pulsar Functions Worker authorization bypass in trigger endpoint](https://junglewise.ai/threats/cve-2026-105935-the-pulsar-functions-worker-provides-a-rest-api-endpoint-for)