Read the docs
TI-2023-14744 Aliases CVE-2023-31007GHSA-47r2-phr8-m8cp

Apache Pulsar: Broker does not always disconnect client when authentication data expires

Priority LOW 31CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a client connects directly to a broker with a specially crafted connect command when the broker is configured with authenticateOriginalAuthData=false. This issue affects Apache Pulsar: through 2.9.4, from 2.10.0 through 2.10.3, 2.11.0. 2.9 Pulsar Broker users should upgrade to at least 2.9.5. 2.10 Pulsar Broker users should upgrade to at least 2.10.4. 2.11 Pulsar Broker users should upgrade to at least 2.11.1. 3.0 Pulsar Broker users are unaffected. Any users running the Pulsar Broker for 2.8.* and earlier should upgrade to one of the above patched versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0102 63rd percentileScored 2026-11-07
Fix Fixed Apache Pulsar (Apache Software Foundation): 2.9.5org.apache.pulsar:pulsar-broker (Maven): 2.10.4, 2.11.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Pulsarbefore 2.9.5; 2.10.0 – 2.10.3; 2.11.02.9.5Patch availableCNA
—org.apache.pulsar:pulsar-broker (Maven)2.9.0 to before 2.10.42.10.4Patch availableGHSA-47r2-phr8-m8cp
—org.apache.pulsar:pulsar-broker (Maven)2.11.0 to before 2.11.12.11.1Patch availableGHSA-47r2-phr8-m8cp
  • Apache Pulsar VendorApache Affected before 2.9.5; 2.10.0 – 2.10.3; 2.11.0 Fixed in 2.9.5 Patch available CNA
  • org.apache.pulsar:pulsar-broker (Maven) Vendor— Affected 2.9.0 to before 2.10.4 Fixed in 2.10.4 Patch available GHSA-47r2-phr8-m8cp
  • org.apache.pulsar:pulsar-broker (Maven) Vendor— Affected 2.11.0 to before 2.11.1 Fixed in 2.11.1 Patch available GHSA-47r2-phr8-m8cp

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*before 2.9.5; 2.10.0 – 2.10.3VulnerableApache
cpe:2.3:a:apache:pulsar:2.11.0:-:*:*:*:*:*:*2.11.0VulnerableApache
cpe:2.3:a:apache:pulsar:2.11.0:candidate_1:*:*:*:*:*:*2.11.0 candidate_1VulnerableApache
cpe:2.3:a:apache:pulsar:2.11.0:candidate_5:*:*:*:*:*:*2.11.0 candidate_5VulnerableApache
  • cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:* Versions before 2.9.5; 2.10.0 – 2.10.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:pulsar:2.11.0:-:*:*:*:*:*:* Versions 2.11.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:pulsar:2.11.0:candidate_1:*:*:*:*:*:* Versions 2.11.0 candidate_1 Vulnerable ·Apache
  • cpe:2.3:a:apache:pulsar:2.11.0:candidate_5:*:*:*:*:*:* Versions 2.11.0 candidate_5 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Pulsar (Apache Software Foundation) Fixed in 2.9.5
  • Fix · GHSA-47r2-phr8-m8cp org.apache.pulsar:pulsar-broker (Maven) Fixed in 2.10.4 Advisory →
  • Fix · GHSA-47r2-phr8-m8cp org.apache.pulsar:pulsar-broker (Maven) Fixed in 2.11.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-31007
  2. 2026-10-03 Alias added: GHSA-47r2-phr8-m8cp

References

Advisory 2

Other 1

  • TI-2024-18155 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification CVSS 3.1CRITICAL 9.9
  • TI-2021-05150 Authentication with JWT allows use of “none”-algorithm CVSS 3.1CRITICAL 9.8
  • TI-2024-17990 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution CVSS 3.1CRITICAL 9.9
  • TI-2023-14272 Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy CVSS 3.1CRITICAL 9.6
  • TI-2022-15232 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint CVSS 3.1HIGH 8.2
  • TI-2024-18500 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying CVSS 3.1HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences