Skip to content
fr Sign in
Not rated

CVE-2021-41571 In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the…

Description

In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions.

Affected products and versions

Product Affected versions Fixed in
Apache Pulsar 2.8 earliest → 2.8.0 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Pulsar

The 30 CVEs of Apache Pulsar →
CVE-2026-105945 The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by… 7.7 High CVE-2026-105942 When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the… 7.7 High CVE-2026-105938 Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription… 2.3 Low CVE-2026-105937 Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's… 8.7 High
Track this CVE