Not rated
CVE-2022-33683 Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates,…
Description
Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middle attacks, which could leak authentication data, configuration data, and any other data sent by these clients. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack. This issue affects Apache Pulsar Broker and Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Pulsar | 2.10.0 | No fix stated |
| Apache Pulsar 2.9 | 2.9 → 2.9.2 | No fix stated |
| Apache Pulsar 2.8 | 2.8 → 2.8.3 | No fix stated |
| Apache Pulsar 2.7 | 2.7 → 2.7.4 | No fix stated |
| Apache Pulsar 2.6 | earliest → 2.6.4 | No fix stated |
References
- lists.apache.org lists.apache.org
Timeline
- Published
- Last modified
Other CVEs of Apache Pulsar
The 30 CVEs of Apache Pulsar →
CVE-2026-105945
The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by…
7.7
High
CVE-2026-105942
When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the…
7.7
High
CVE-2026-105938
Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription…
2.3
Low
CVE-2026-105937
Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's…
8.7
High