Skip to content
fr Sign in
6.4 Medium

CVE-2024-28098 The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies,…

Description

The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading settings. These management operations should be restricted to users with the tenant admin role or super user role. This issue affects Apache Pulsar versions from 2.7.1 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. 2.10 Apache Pulsar users should upgrade to at least 2.10.6. 2.11 Apache Pulsar users should upgrade to at least 2.11.4. 3.0 Apache Pulsar users should upgrade to at least 3.0.3. 3.1 Apache Pulsar users should upgrade to at least 3.1.3. 3.2 Apache Pulsar users should upgrade to at least 3.2.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

Affected products and versions

Product Affected versions Fixed in
Apache Pulsar 3.2 3.2.0 → < 3.2.1 3.2.1
Apache Pulsar 3.1 3.1.0 → < 3.1.3 3.1.3
Apache Pulsar 3.0 3.0.0 → < 3.0.3 3.0.3
Apache Pulsar 2.11 2.11.0 → < 2.11.4 2.11.4
Apache Pulsar 2.7 2.7.1 → < 2.10.6 2.10.6

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Apache Pulsar

The 30 CVEs of Apache Pulsar →
CVE-2026-105945 The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by… 7.7 High CVE-2026-105942 When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the… 7.7 High CVE-2026-105938 Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription… 2.3 Low CVE-2026-105937 Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's… 8.7 High
Track this CVE