Apache Pulsar Manager missing auth leaks admin credentials (CVE-2026-105944)
Original title: Apache Pulsar Manager: CVE-2026-105944, missing authentication and admin credential disclosure; end of life
The Apache Pulsar PMC says the end-of-life manager lacks authentication and authorization and can expose Pulsar admin credentials.
Lari Hotari forwarded an Apache Pulsar PMC advisory for CVE-2026-105944 on October 21. The notice covers Apache Pulsar Manager and describes missing authentication and authorization plus disclosure of Pulsar admin credentials. The posted excerpt also marks the component end of life and does not give version ranges or a patch.
Unconfirmed: The excerpt does not state affected versions, a fixed release, or known exploitation.
- The advisory was posted to the Apache mailing list on October 21.
- The flaw is tracked as CVE-2026-105944.
- The announcement labels Apache Pulsar Manager end of life.
Impact: Missing authentication and disclosure of Pulsar admin credentials
| Product | Affected |
|---|---|
| Apache Pulsar Manager | — |
- 1.Stop using end-of-life Apache Pulsar Manager.
- CVEs
- CVE-2026-105944
- Vendors
- Apache
- Products
- Pulsar Manager
- Organizations
- Apache Pulsar PMC
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105944 | Missing auth and credential leak in Apache Pulsar Manager | 10.0 | — |
From the original article
Posted by Lari Hotari on Oct 21 The Apache Pulsar PMC has published the following security advisory for https://lists. apache. org/thread/hol3z7fzhjntwvrv8xqqwx4l4d2jx796 CVE-2026-105944: Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.