Apache Pulsar PMC posts release fixes and a manager advisory

1 source · 2 articlesFirst reported Oct 21, 2026 · 20:41 UTCUpdated Oct 21, 2026 · 20:43 UTC (9d ago)1

What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

On October 21 the Pulsar PMC announced 14 fixes in three releases and end-of-life manager flaw CVE-2026-105944.

On October 21, Lari Hotari forwarded Apache Pulsar PMC notices to the oss-security list. One combined announcement says 14 security issues are fixed in Pulsar 4.0.14, 4.2.5, and 5.0.0, but the excerpt omits each CVE id, impact, and vulnerable ranges. A separate notice covers Apache Pulsar Manager as CVE-2026-105944: missing authentication and authorization that can expose Pulsar admin credentials. The manager is labeled end of life, and the excerpt gives no version ranges or patch. The posted text does not describe exploitation.

Key facts

Fourteen Pulsar issues are fixed in 4.0.14, 4.2.5, and 5.0.0.
The combined excerpt omits individual CVE ids and affected ranges.
CVE-2026-105944 affects Apache Pulsar Manager, not those Pulsar releases.
Manager lacks authentication and authorization and can disclose admin credentials.
The PMC labels Pulsar Manager end of life, with no patch stated.

Analyze CVE-2026-105944 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first

Oct 21, 2026PMC announces 14 Pulsar fixes in three releases · oss-security
Oct 21, 2026PMC discloses Pulsar Manager CVE-2026-105944 and end of life · oss-security

What each outlet adds

beyond the shared facts

oss-securityNames fixed Pulsar releases but omits the 14 CVE details.
oss-securityIdentifies manager CVE-2026-105944, credential exposure, and end of life.

CVEs: CVE-2026-105944

Vendors: Apache
Products: Pulsar Manager Apache Pulsar
Organizations: Apache Pulsar PMC

Coverage

oldest first · one row per article · UTC

Oct 21, 20:41 UTC · 9d ago oss-securityFirst report
Apache Pulsar fixes 14 CVEs in 4.0.14, 4.2.5, and 5.0.0
The Pulsar PMC posted a combined advisory, but the excerpt omits the individual CVE ids and affected ranges.
Oct 21, 20:43 UTC · 9d ago oss-security
Apache Pulsar Manager missing auth leaks admin credentials (CVE-2026-105944)
The Apache Pulsar PMC says the end-of-life manager lacks authentication and authorization and can expose Pulsar admin credentials.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2026-105944	Missing auth and credential leak in Apache Pulsar Manager	10.0	—		9d ago