Non notée
CVE-2021-41571 In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the…
Description
In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Pulsar 2.8 | premières → 2.8.0 | Pas de correctif indiqué |
Références
- pulsar.apache.org pulsar.apache.org
- github.com github.com
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Pulsar
Les 30 CVE de Apache Pulsar →
CVE-2026-105945
The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by…
7.7
Élevée
CVE-2026-105942
When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the…
7.7
Élevée
CVE-2026-105938
Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription…
2.3
Faible
CVE-2026-105937
Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's…
8.7
Élevée