Apache Pulsar Broker: Incorrect Authorization Validation for Rest Producer
Description
Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to produce a message to any topic using the broker's admin role. This issue affects Apache Pulsar Brokers: from 2.9.0 through 2.9.5, from 2.10.0 before 2.10.4, 2.11.0.
The vulnerability is exploitable when an attacker can connect directly to the Pulsar Broker. If an attacker is connecting through the Pulsar Proxy, there is no known way to exploit this authorization vulnerability.
There are two known risks for affected users. First, an attacker could produce garbage messages to any topic in the cluster. Second, an attacker could produce messages to the topic level policies topic for other tenants and influence topic settings that could lead to exfiltration and/or deletion of messages for other tenants.
2.8 Pulsar Broker users and earlier are unaffected. 2.9 Pulsar Broker users should upgrade to one of the patched versions. 2.10 Pulsar Broker users should upgrade to at least 2.10.4. 2.11 Pulsar Broker users should upgrade to at least 2.11.1. 3.0 Pulsar Broker users are unaffected.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
An authenticated attacker can send a crafted HTTP header to a vulnerable Apache Pulsar Broker to produce messages to any topic, bypassing authorization checks.
Vulnerability
Overview
CVE-2023-30428 is an incorrect authorization vulnerability in the Apache Pulsar Broker's REST producer. An authenticated user can leverage a custom HTTP header to assume the broker's admin role, allowing them to produce messages to any topic in the cluster. This issue affects Apache Pulsar Brokers versions 2.9.0 through 2.9.5, 2.10.0 before 2.10.4, and 2.11.0 [2].
Exploitation
The attack requires the ability to connect directly to the Pulsar Broker; if the connection goes through the Pulsar Proxy, the vulnerability is not known to be exploitable [2]. An attacker must already be authenticated to the broker, and no additional privileges are needed beyond the crafted header [2].
Impact
A successful exploit enables two primary risks: the attacker can produce garbage messages to any topic, disrupting service, and can produce messages to the topic-level policies topic for other tenants. This could allow the attacker to influence topic settings, potentially leading to exfiltration or deletion of messages belonging to other tenants [2].
Mitigation
Users of affected versions should upgrade immediately. The patched versions are: 2.9.x users should upgrade to 2.9.6 or later, 2.10.x users to 2.10.4, and 2.11.0 users to 2.11.1. Users on 2.8.x or earlier, or 3.0.x, are unaffected [2].
AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.pulsar:pulsar-brokerMaven | >= 2.9.0, < 2.10.4 | 2.10.4 |
org.apache.pulsar:pulsar-brokerMaven | >= 2.11.0, < 2.11.1 | 2.11.1 |
Affected products
3- Range: 2.9.0-2.9.5, 2.10.0-2.10.3, 2.11.0
- Range: 2.9.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- github.com/advisories/GHSA-j2r7-3rvw-g7gxghsaADVISORY
- lists.apache.org/thread/v39hqtgrmyxr85rmofwvgrktnflbq3q5ghsavendor-advisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-30428ghsaADVISORY
News mentions
0No linked articles in our index yet.