Authentication with JWT allows use of “none”-algorithm
Priority HIGH 74CWE-347Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-347.
Summary
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).
Why it matters now
EPSS 0.52926 98th percentileScored 2026-11-07
Fix Fixed Apache Pulsar (Apache Software Foundation): 2.7.1org.apache.pulsar:pulsar (Maven): 2.7.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Pulsar | Apache Pulsar to before 2.7.1 | 2.7.1 | Patch available | CNA |
| — | org.apache.pulsar:pulsar (Maven) | before 2.7.2 | 2.7.2 | Patch available | GHSA-3cv4-xxv7-934q |
- Apache Pulsar VendorApache Affected Apache Pulsar to before 2.7.1 Fixed in 2.7.1 Patch available CNA
- org.apache.pulsar:pulsar (Maven) Vendor— Affected before 2.7.2 Fixed in 2.7.2 Patch available GHSA-3cv4-xxv7-934q
Remediation
- Fix · CNA Apache Pulsar (Apache Software Foundation) Fixed in 2.7.1
- Fix · GHSA-3cv4-xxv7-934q org.apache.pulsar:pulsar (Maven) Fixed in 2.7.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-22160
- 2026-10-03 Alias added: GHSA-3cv4-xxv7-934q
References
Advisory 3
Other 16
- [pulsar-dev] 20210527 Cutting 2.6.4 release to address CVE-2021-22160
- [pulsar-dev] 20210527 Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of "none"-algorithm
- [pulsar-users] 20210527 Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of "none"-algorithm
- [pulsar-dev] 20210527 Re: Cutting 2.6.4 release to address CVE-2021-22160
- [pulsar-dev] 20210531 Re: [DISCUSS] Propose More Formal Policy for Security Patches and EOL of Versions
- [pulsar-dev] 20210604 Re: [DISCUSS] Propose More Formal Policy for Security Patches and EOL of Versions
- https://github.com/apache/pulsar/releases/tag/v2.7.2
- https://lists.apache.org/thread.html/r08c7df60cae031361df7fbac39d08b6d5b5079e74db5195d409db9a2@%3Cdev.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r8e545559781231a83bf0644548c660255859e52feb86bbfcd42590da@%3Cdev.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/ra49cb62105154e4795b259c79a6b27d63bfa2ab5787ff8529b089550@%3Cdev.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/ra49cb62105154e4795b259c79a6b27d63bfa2ab5787ff8529b089550@%3Cusers.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rbe845aa1573a61769b9c5916c62971f4b10de87c2ea5f38a97f0cf84@%3Cdev.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rca54f4b26ba5e6f2e39732b47ec51640e89f57e3b6a38ac3bab314df@%3Cdev.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/re2ae364e0c02093dc721699698c6f23cfbba0220c78b5e28cafeae81@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rf2e90942996dceebac8296abf39257cfeb5ae918f82f7af3d37a48c5@%3Cdev.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rf54fefc25c49d4715d484133d438f13bf2e515a5fed5d3a745d4f6e7@%3Ccommits.pulsar.apache.org%3E
More Apache Pulsar vulnerabilities
- TI-2024-18155 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification CVSS 3.1CRITICAL 9.9
- TI-2024-17990 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution CVSS 3.1CRITICAL 9.9
- TI-2023-14272 Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy CVSS 3.1CRITICAL 9.6
- TI-2022-15232 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint CVSS 3.1HIGH 8.2
- TI-2024-18500 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying CVSS 3.1HIGH 8.8
- TI-2023-19177 Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials CVSS 3.1HIGH 8.2
Sources
- CVE-2021-22160 · CVE Program
- CVE-2021-22160 · NVD
- FIRST EPSS
- GHSA-3cv4-xxv7-934q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences