TI-2023-14272 Aliases CVE-2023-30429 GHSA-g9cv-v3v4-3h8r

Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy

MEDIUM 45CWE-863Published 2023-07-12 · Updated 2024-10-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When a client connects to the Pulsar Function Worker via the Pulsar Proxy where the Pulsar Proxy uses mTLS authentication to authenticate with the Pulsar Function Worker, the Pulsar Function Worker incorrectly performs authorization by using the Proxy's role for authorization instead of the client's role, which can lead to privilege escalation, especially if the proxy is configured with a superuser role. The recommended mitigation for impacted users is to upgrade the Pulsar Function Worker to a patched version. 2.10 Pulsar Function Worker users should upgrade to at least 2.10.4. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.1. 3.0 Pulsar Function Worker users are unaffected. Any users running the Pulsar Function Worker for 2.9.* and earlier should upgrade to one of the above patched versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01035 64th percentileScored 2026-11-07

Fix Fixed Apache Pulsar (Apache Software Foundation): 2.10.4org.apache.pulsar:pulsar (Maven): 2.10.4, 2.11.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Pulsar	before 2.10.4; 2.11.0	2.10.4	Patch available	CNA
—	org.apache.pulsar:pulsar (Maven)	before 2.10.4	2.10.4	Patch available	GHSA-g9cv-v3v4-3h8r
—	org.apache.pulsar:pulsar (Maven)	2.11.0 to before 2.11.1	2.11.1	Patch available	GHSA-g9cv-v3v4-3h8r

Apache Pulsar VendorApache Affected before 2.10.4; 2.11.0 Fixed in 2.10.4 Patch available CNA
org.apache.pulsar:pulsar (Maven) Vendor— Affected before 2.10.4 Fixed in 2.10.4 Patch available GHSA-g9cv-v3v4-3h8r
org.apache.pulsar:pulsar (Maven) Vendor— Affected 2.11.0 to before 2.11.1 Fixed in 2.11.1 Patch available GHSA-g9cv-v3v4-3h8r

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:pulsar::::::::	before 2.10.4	Vulnerable	Apache
cpe:2.3:a:apache:pulsar:2.11.0:-::::::	2.11.0	Vulnerable	Apache
cpe:2.3:a:apache:pulsar:2.11.0:candidate_1::::::	2.11.0 candidate_1	Vulnerable	Apache
cpe:2.3:a:apache:pulsar:2.11.0:candidate_5::::::	2.11.0 candidate_5	Vulnerable	Apache

cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:* Versions before 2.10.4 Vulnerable ·Apache
cpe:2.3:a:apache:pulsar:2.11.0:-:*:*:*:*:*:* Versions 2.11.0 Vulnerable ·Apache
cpe:2.3:a:apache:pulsar:2.11.0:candidate_1:*:*:*:*:*:* Versions 2.11.0 candidate_1 Vulnerable ·Apache
cpe:2.3:a:apache:pulsar:2.11.0:candidate_5:*:*:*:*:*:* Versions 2.11.0 candidate_5 Vulnerable ·Apache

Remediation

Fix · CNA Apache Pulsar (Apache Software Foundation) Fixed in 2.10.4
Fix · GHSA-g9cv-v3v4-3h8r org.apache.pulsar:pulsar (Maven) Fixed in 2.10.4 Advisory →
Fix · GHSA-g9cv-v3v4-3h8r org.apache.pulsar:pulsar (Maven) Fixed in 2.11.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-30429
2026-10-03 Alias added: GHSA-g9cv-v3v4-3h8r

References

Advisory 2

Other 1

https://github.com/apache/pulsar

TI-2024-18155 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification CVSS 3.1CRITICAL 9.9
TI-2021-05150 Authentication with JWT allows use of “none”-algorithm CVSS 3.1CRITICAL 9.8
TI-2024-17990 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution CVSS 3.1CRITICAL 9.9
TI-2022-15232 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint CVSS 3.1HIGH 8.2
TI-2024-18500 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying CVSS 3.1HIGH 8.8
TI-2023-19177 Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials CVSS 3.1HIGH 8.2

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences