Read the docs
TI-2021-18308 Aliases CVE-2021-41571GHSA-3whx-qrj5-hh2h

Pulsar Admin API allows access to data from other tenants using getMessageById API

Priority LOW 32CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions.

Why it matters now

EPSS 0.01726 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.apache.pulsar:pulsar (Maven): 2.7.4, 2.8.1Red Hat: 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache PulsarApache Pulsar – 2.8.0—No fix listedCNA
—org.apache.pulsar:pulsar (Maven)up to 2.6.4—No fix listedGHSA-3whx-qrj5-hh2h
—org.apache.pulsar:pulsar (Maven)2.7.0 to before 2.7.42.7.4Patch availableGHSA-3whx-qrj5-hh2h
—org.apache.pulsar:pulsar (Maven)2.8.0 to before 2.8.12.8.1Patch availableGHSA-3whx-qrj5-hh2h
  • Apache Pulsar VendorApache Affected Apache Pulsar – 2.8.0 Fixed in — No fix listed CNA
  • org.apache.pulsar:pulsar (Maven) Vendor— Affected up to 2.6.4 Fixed in — No fix listed GHSA-3whx-qrj5-hh2h
  • org.apache.pulsar:pulsar (Maven) Vendor— Affected 2.7.0 to before 2.7.4 Fixed in 2.7.4 Patch available GHSA-3whx-qrj5-hh2h
  • org.apache.pulsar:pulsar (Maven) Vendor— Affected 2.8.0 to before 2.8.1 Fixed in 2.8.1 Patch available GHSA-3whx-qrj5-hh2h

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*2.6.0 to before 2.6.4; 2.7.0 to before 2.7.3VulnerableApache
cpe:2.3:a:apache:pulsar:2.8.0:*:*:*:*:*:*:*2.8.0VulnerableApache
  • cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:* Versions 2.6.0 to before 2.6.4; 2.7.0 to before 2.7.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:pulsar:2.8.0:*:*:*:*:*:*:* Versions 2.8.0 Vulnerable ·Apache

Remediation

  • Fix · GHSA-3whx-qrj5-hh2h org.apache.pulsar:pulsar (Maven) Fixed in 2.7.4 Advisory →
  • Fix · GHSA-3whx-qrj5-hh2h org.apache.pulsar:pulsar (Maven) Fixed in 2.8.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel K 1AffectedNo fix yet

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41571
  2. 2026-10-03 Alias added: GHSA-3whx-qrj5-hh2h

References

Exploit 1

Patch 1

Advisory 2

Other 6

  • TI-2024-18155 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification CVSS 3.1CRITICAL 9.9
  • TI-2021-05150 Authentication with JWT allows use of “none”-algorithm CVSS 3.1CRITICAL 9.8
  • TI-2024-17990 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution CVSS 3.1CRITICAL 9.9
  • TI-2023-14272 Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy CVSS 3.1CRITICAL 9.6
  • TI-2022-15232 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint CVSS 3.1HIGH 8.2
  • TI-2024-18500 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying CVSS 3.1HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences