CVE-2026-105944: Apache Pulsar Manager 0.1.0 through 0.4.0

Affected technology

Apache Pulsar Manager · 0.1.0 through 0.4.0
Apache Software Foundation

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An unauthenticated user can therefore use Pulsar Manager to send requests to the Pulsar admin API, which the cluster processes with the credential configured in Pulsar Manager. - The destination of a proxied request can be chosen by the requester, and Pulsar Manager attaches its configured Pulsar admin credential to the request. Vendor/CNA’s CVSS 4.0 assessment (base score 10.0/10) rates confidentiality, integrity and availability impact as high.