Read the docs
TI-2024-19610 Aliases CVE-2024-29834GHSA-7mg2-6c6v-342r

Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints

Priority LOW 31CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering compaction. These management operations should be restricted to users with the tenant admin role or superuser role. An authenticated user with produce permission can create subscriptions and update subscription properties on partitioned topics, even though this should be limited to users with consume permissions. This impact analysis assumes that Pulsar has been configured with the default authorization provider. For custom authorization providers, the impact could be slightly different. Additionally, the vulnerability allows an authenticated user to read, create, modify, and delete namespace properties in any namespace in any tenant. In Pulsar, namespace properties are reserved for user provided metadata about the namespace. This issue affects Apache Pulsar versions from 2.7.1 to 2.10.6, from 2.11.0 to 2.11.4, from 3.0.0 to 3.0.3, from 3.1.0 to 3.1.3, and from 3.2.0 to 3.2.1. 3.0 Apache Pulsar users should upgrade to at least 3.0.4. 3.1 and 3.2 Apache Pulsar users should upgrade to at least 3.2.2. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01359 71st percentileScored 2026-11-07
Fix Partial Apache Pulsar (Apache Software Foundation): 3.0.4, 3.2.2org.apache.pulsar:pulsar-broker (Maven): 3.0.4, 3.2.2Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Pulsar2.7.1 – 2.10.6; 2.11.0 – 2.11.4; 3.0.0 to before 3.0.4; 3.1.0 – 3.1.3; 3.2.0 to before 3.2.23.0.4, 3.2.2Patch availableCNA
—org.apache.pulsar:pulsar-broker (Maven)2.7.1 – 2.10.6—No fix listedGHSA-7mg2-6c6v-342r
—org.apache.pulsar:pulsar-broker (Maven)2.11.0 – 2.11.4—No fix listedGHSA-7mg2-6c6v-342r
—org.apache.pulsar:pulsar-broker (Maven)3.0.0 to before 3.0.43.0.4Patch availableGHSA-7mg2-6c6v-342r
—org.apache.pulsar:pulsar-broker (Maven)3.1.0 – 3.1.3—No fix listedGHSA-7mg2-6c6v-342r
—org.apache.pulsar:pulsar-broker (Maven)3.2.0 to before 3.2.23.2.2Patch availableGHSA-7mg2-6c6v-342r
  • Apache Pulsar VendorApache Affected 2.7.1 – 2.10.6; 2.11.0 – 2.11.4; 3.0.0 to before 3.0.4; 3.1.0 – 3.1.3; 3.2.0 to before 3.2.2 Fixed in 3.0.4, 3.2.2 Patch available CNA
  • org.apache.pulsar:pulsar-broker (Maven) Vendor— Affected 2.7.1 – 2.10.6 Fixed in — No fix listed GHSA-7mg2-6c6v-342r
  • org.apache.pulsar:pulsar-broker (Maven) Vendor— Affected 2.11.0 – 2.11.4 Fixed in — No fix listed GHSA-7mg2-6c6v-342r
  • org.apache.pulsar:pulsar-broker (Maven) Vendor— Affected 3.0.0 to before 3.0.4 Fixed in 3.0.4 Patch available GHSA-7mg2-6c6v-342r
  • org.apache.pulsar:pulsar-broker (Maven) Vendor— Affected 3.1.0 – 3.1.3 Fixed in — No fix listed GHSA-7mg2-6c6v-342r
  • org.apache.pulsar:pulsar-broker (Maven) Vendor— Affected 3.2.0 to before 3.2.2 Fixed in 3.2.2 Patch available GHSA-7mg2-6c6v-342r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*2.7.1 – 2.10.6; 2.11.0 – 2.11.4; 3.0.0 to before 3.0.4; 3.1.0 – 3.1.3; 3.2.0 to before 3.2.2VulnerableApache
  • cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:* Versions 2.7.1 – 2.10.6; 2.11.0 – 2.11.4; 3.0.0 to before 3.0.4; 3.1.0 – 3.1.3; 3.2.0 to before 3.2.2 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Pulsar (Apache Software Foundation) Fixed in 3.0.4, 3.2.2
  • Fix · GHSA-7mg2-6c6v-342r org.apache.pulsar:pulsar-broker (Maven) Fixed in 3.0.4 Advisory →
  • Fix · GHSA-7mg2-6c6v-342r org.apache.pulsar:pulsar-broker (Maven) Fixed in 3.2.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Not affected: 4 products
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-29834
  2. 2026-10-03 Alias added: GHSA-7mg2-6c6v-342r

References

Advisory 4

Other 4

  • TI-2024-18155 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification CVSS 3.1CRITICAL 9.9
  • TI-2021-05150 Authentication with JWT allows use of “none”-algorithm CVSS 3.1CRITICAL 9.8
  • TI-2024-17990 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution CVSS 3.1CRITICAL 9.9
  • TI-2023-14272 Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy CVSS 3.1CRITICAL 9.6
  • TI-2022-15232 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint CVSS 3.1HIGH 8.2
  • TI-2024-18500 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying CVSS 3.1HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences