Read the docs
TI-2024-18679 Aliases CVE-2024-28098GHSA-g627-r579-rw35

Apache Pulsar: Improper Authorization For Topic-Level Policy Management

Priority LOW 32CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading settings. These management operations should be restricted to users with the tenant admin role or super user role. This issue affects Apache Pulsar versions from 2.7.1 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. 2.10 Apache Pulsar users should upgrade to at least 2.10.6. 2.11 Apache Pulsar users should upgrade to at least 2.11.4. 3.0 Apache Pulsar users should upgrade to at least 3.0.3. 3.1 Apache Pulsar users should upgrade to at least 3.1.3. 3.2 Apache Pulsar users should upgrade to at least 3.2.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01701 77th percentileScored 2026-11-07
Fix Fixed Apache Pulsar (Apache Software Foundation): 2.10.6, 2.11.4, 3.0.3 +2org.apache.pulsar:pulsar-broker (Maven): 3.2.1, 3.1.3, 3.0.3 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Pulsar2.7.1 to before 2.10.6; 2.11.0 to before 2.11.4; 3.0.0 to before 3.0.3; 3.1.0 to before 3.1.3; 3.2.0 to before 3.2.12.10.6, 2.11.4, 3.0.3, 3.1.3, 3.2.1Patch availableCNA
—org.apache.pulsar:pulsar-broker (Maven)3.2.0 to before 3.2.13.2.1Patch availableGHSA-g627-r579-rw35
—org.apache.pulsar:pulsar-broker (Maven)3.1.0 to before 3.1.33.1.3Patch availableGHSA-g627-r579-rw35
—org.apache.pulsar:pulsar-broker (Maven)3.0.0 to before 3.0.33.0.3Patch availableGHSA-g627-r579-rw35
—org.apache.pulsar:pulsar-broker (Maven)2.11.0 to before 2.11.42.11.4Patch availableGHSA-g627-r579-rw35
—org.apache.pulsar:pulsar-broker (Maven)2.7.1 to before 2.10.62.10.6Patch availableGHSA-g627-r579-rw35
  • Apache Pulsar VendorApache Affected 2.7.1 to before 2.10.6; 2.11.0 to before 2.11.4; 3.0.0 to before 3.0.3; 3.1.0 to before 3.1.3; 3.2.0 to before 3.2.1 Fixed in 2.10.6, 2.11.4, 3.0.3, 3.1.3, 3.2.1 Patch available CNA
  • org.apache.pulsar:pulsar-broker (Maven) Vendor— Affected 3.2.0 to before 3.2.1 Fixed in 3.2.1 Patch available GHSA-g627-r579-rw35
  • org.apache.pulsar:pulsar-broker (Maven) Vendor— Affected 3.1.0 to before 3.1.3 Fixed in 3.1.3 Patch available GHSA-g627-r579-rw35
  • org.apache.pulsar:pulsar-broker (Maven) Vendor— Affected 3.0.0 to before 3.0.3 Fixed in 3.0.3 Patch available GHSA-g627-r579-rw35
  • org.apache.pulsar:pulsar-broker (Maven) Vendor— Affected 2.11.0 to before 2.11.4 Fixed in 2.11.4 Patch available GHSA-g627-r579-rw35
  • org.apache.pulsar:pulsar-broker (Maven) Vendor— Affected 2.7.1 to before 2.10.6 Fixed in 2.10.6 Patch available GHSA-g627-r579-rw35

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*2.7.1 to before 2.10.6; 2.11.0 to before 2.11.4; 3.0.0 to before 3.0.3; 3.1.0 to before 3.1.3VulnerableApache
cpe:2.3:a:apache:pulsar:3.2.0:-:*:*:*:*:*:*3.2.0VulnerableApache
  • cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:* Versions 2.7.1 to before 2.10.6; 2.11.0 to before 2.11.4; 3.0.0 to before 3.0.3; 3.1.0 to before 3.1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:pulsar:3.2.0:-:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Pulsar (Apache Software Foundation) Fixed in 2.10.6, 2.11.4, 3.0.3, 3.1.3, 3.2.1
  • Fix · GHSA-g627-r579-rw35 org.apache.pulsar:pulsar-broker (Maven) Fixed in 3.2.1 Advisory →
  • Fix · GHSA-g627-r579-rw35 org.apache.pulsar:pulsar-broker (Maven) Fixed in 3.1.3 Advisory →
  • Fix · GHSA-g627-r579-rw35 org.apache.pulsar:pulsar-broker (Maven) Fixed in 3.0.3 Advisory →
  • Fix · GHSA-g627-r579-rw35 org.apache.pulsar:pulsar-broker (Maven) Fixed in 2.11.4 Advisory →
  • Fix · GHSA-g627-r579-rw35 org.apache.pulsar:pulsar-broker (Maven) Fixed in 2.10.6 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Pulsar 2.10.6, 2.11.4 and 3 more versions

    4 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-18155 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File ModificationPriority HIGH 76
    • TI-2024-17990 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code ExecutionPriority MEDIUM 52
    • TI-2024-18500 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS ProxyingPriority MEDIUM 42
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 5 products
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-28098
  2. 2026-10-03 Alias added: GHSA-g627-r579-rw35

References

Advisory 4

Other 2

  • TI-2024-18155 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification CVSS 3.1CRITICAL 9.9
  • TI-2021-05150 Authentication with JWT allows use of “none”-algorithm CVSS 3.1CRITICAL 9.8
  • TI-2024-17990 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution CVSS 3.1CRITICAL 9.9
  • TI-2023-14272 Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy CVSS 3.1CRITICAL 9.6
  • TI-2022-15232 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint CVSS 3.1HIGH 8.2
  • TI-2024-18500 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying CVSS 3.1HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences