CVE-2026-105937: Apache Pulsar 3.0.0 to before 4.0.14, 4.1.0 to before 4.2.5

Affected technology

Apache Pulsar · 3.0.0 to before 4.0.14, 4.1.0 to before 4.2.5
Apache Software Foundation

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The user can then consume from the shadow topic, using only permissions on their own topic, and receive retained messages that were published to the source topic in the other tenant. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality, integrity and availability impact as high.