Is CVE-2026-105945 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105945 being exploited in the wild.

How severe is CVE-2026-105945?

Informational severity, published 21 October 2026.

Which products and versions are affected?

Apache Pulsar 2.10.0 to before 4.0.14; 4.1.0 to before 4.2.5.

How is CVE-2026-105945 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-105945?

Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105945: Apache Pulsar path traversal in package management filesystem storage

CVE-2026-105945 · Severity: info · Published 2026-10-21

Apache Pulsar's package management service allows administrators to store software packages on the broker's local filesystem. An authenticated user with package permissions on one namespace can exploit path traversal in the version field to access, modify, or delete packages from other namespaces they have no permission for, potentially affecting Pulsar Functions and data integrity. This issue only impacts deployments that explicitly enable filesystem-based package storage, not the default configuration.

Technologies: Apache Pulsar. Vendors: Apache.

Quick answers

Is CVE-2026-105945 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105945 being exploited in the wild.
How severe is CVE-2026-105945?: Informational severity, published 21 October 2026.
Which products and versions are affected?: Apache Pulsar 2.10.0 to before 4.0.14; 4.1.0 to before 4.2.5.
Is there a fix for CVE-2026-105945?: Yes: fixed in 4.0.14, 4.2.5. Until then: Disable package management unless explicitly required by setting enablePackagesManagement to false, or use the default Apache BookKeeper storage provider instead of the filesystem storage provider. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105945 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-105945?: Check whether you run Apache Pulsar at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.0.14, 4.2.5

Disable package management unless explicitly required by setting enablePackagesManagement to false, or use the default Apache BookKeeper storage provider instead of the filesystem storage provider.

Technical details

The vulnerability is a path traversal flaw in Apache Pulsar's FileSystemPackagesStorageProvider where the version component of package names is not validated for URL-encoded path separators and parent directory references. An authenticated attacker with packages permission on any namespace can craft a malicious version string to resolve to storage locations outside their authorized scope but still within the configured storage directory, bypassing containment checks. This allows read, write, or delete access to packages in other tenants or namespaces, affecting the integrity and availability of Pulsar Functions, Sources, and Sinks that depend on those packages.

Affected products

Apache Pulsar 2.10.0 to before 4.0.14; 4.1.0 to before 4.2.5

Timeline

2026-10-21: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.