<!channel> 🚨 Several security advisories (CVEs) for the Apache Pulsar project were published today. 🚨 For Apache Pulsar components, these are fixed in the 4.0.14, 4.2.5, and 5.0.0 releases: • CVE-2026-105945: Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage • CVE-2026-105942: Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation • CVE-2026-105938: Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all • CVE-2026-105937: Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data • CVE-2026-105936: Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint • CVE-2026-105935: Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission • CVE-2026-105934: Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic • CVE-2026-105933: Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization • CVE-2026-105932: Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints • CVE-2026-105931: Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants • CVE-2026-105930: Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download • CVE-2026-105927: Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission • CVE-2026-105926: Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands • CVE-2026-105869: Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role In Apache Pulsar Manager, this advisory covers multiple critical vulnerabilities (CVSS 10.0), and no fix is available. The project’s end of life is announced with this CVE: • CVE-2026-105944: Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life Unfortunately, there’s a delay in updating the website. The recent security advisory information will also be available at pulsar.apache.org/security#… once the GitHub Actions workflow has run. (There have been some GitHub availability incidents today.)