Zero Radar
← feed
CriticalVulnerabilityCVE-2026-105944updated 25 Oct 2026, 16:35 UTC

Apache Pulsar Manager has unfixable open access flaws; stop using it

Pulsar Manager is a web control panel for Pulsar message clusters. Anyone who can reach it over the network can take it over and reach the cluster behind it, and the project will not release a fix.

No fix yetOfficial, 2 sources
SeverityCriticalCVSS 10 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Not yetUse the workaround below until a patch ships
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker reaches consoleNo login needed for admin creation
  2. 2Creates admin accountSetup endpoint stays open after init
  3. 3Proxies admin requestsPulsar Manager skips auth on some calls
  4. 4Credential sent outAttacker picks destination host
  5. 5Pulsar cluster controlledStolen token used directly on cluster
  6. ResultAttacker controls the Pulsar cluster

What happened

Apache Pulsar Manager (0.2.0 and 0.3.0 and later) has unauthenticated admin account creation, unauthenticated proxying of Pulsar admin API requests using its stored credential, and a user-controlled request destination that leaks that credential. The project is retired and no fixes will be made.

Why it is dangerous: Attackers reaching the console can gain full control of Pulsar Manager, run admin operations on the Pulsar cluster, and steal the stored Pulsar credential or token signing key. Anyone running Pulsar Manager on a reachable network is at risk.

Are you affected?

You are affected if you run Apache Pulsar Manager 0.2.0 or any version 0.3.0 and later, especially if it is reachable from untrusted networks or configured with a Pulsar HTTP token or token signing key.

Apache Pulsar Manager 0.2.0 and all versions 0.3.0 and later (no supported versions remain).

What to do

  1. Stop using Pulsar Manager and remove existing deployments
  2. Migrate to an alternative from the Pulsar Administration UI documentation
  3. Replace any Pulsar HTTP token or token signing key that was configured in Pulsar Manager
  4. Until removed, do not expose Pulsar Manager to untrusted networks

Timeline

  1. 21 Oct 2026, 19:16 UTC
    Publicly disclosed
  2. 21 Oct 2026, 19:16 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 16:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-105944 · GHSA-436h-c7mw-9wgf
CVSS
10 / 10
EPSS
0.7% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 19:16 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 16:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Apache Pulsar Manager has unfixable open access flaws; stop using it · Zero Radar