How Do Users Protect Data After Apache Pulsar Manager Retirement Leaves Auth Bypass CVE-2026-105944 Unpatched?

Apache Pulsar Manager, a web console for administering Apache Pulsar clusters, contains critical security flaws that allow unauthorized users to take full control of the system. According to the National Vulnerability Database, these issues affect versions 0.3.0 and later, as well as earlier releases. The Apache Pulsar Project Management Committee has officially retired the software, meaning these vulnerabilities will never be patched.

What does the malicious code exploit?

The primary vulnerability, tracked as CVE-2026-105944, stems from missing authentication and authorization controls. An unauthenticated user who can reach the Pulsar Manager web interface can create a new administrator account at any time. This capability remains available even after the initial setup is complete. Once an attacker creates an account, they gain full administrative privileges because the software does not distinguish between privilege levels for its users.

How do attackers steal credentials?

Beyond creating accounts, the flaws allow attackers to misuse the system’s connection to the backend cluster. When Pulsar Manager is configured with an HTTP authentication token for a Pulsar cluster, it proxies requests to that cluster. The NVD record states that these proxied requests are not subject to Pulsar Manager’s authentication checks. An attacker can force Pulsar Manager to send its configured admin credentials to a host of their choosing, effectively stealing the key needed to control the underlying data infrastructure.

Why is no fix available?

The Apache Pulsar PMC has determined that Pulsar Manager is no longer maintained. According to the official advisory posted to the oss-security mailing list by Lari Hotari, the project has reached end of life. Consequently, there are no supported versions, and no further releases or security updates will be produced. The committee explicitly states that using Pulsar Manager is not recommended and that existing deployments should be removed in favor of alternatives described in the Administration UI documentation.

What should developers do next?

Developers using Pulsar Manager should stop using the software and remove existing deployments immediately. The advisory recommends migrating to one of the supported alternatives listed in the official documentation. If a deployment cannot be removed instantly, users must restrict network access to trusted administrators only and ensure the manager is not exposed to untrusted networks. Those who have exposed the manager with a credential or token signing key should consider replacing that key to prevent unauthorized cluster access.

What analysts watch for

Security teams typically monitor for unauthorized administrator account creation in management consoles, which often signals a compromised authentication boundary. Analysts examine access logs for requests originating from unexpected IP addresses or user agents, particularly those attempting to configure system settings or export configuration data. They also look for unusual outbound traffic from the management server, which may indicate credential exfiltration via server-side request forgery. Regular audits of user permissions and network segmentation rules help detect deviations from established baselines before full administrative control is lost.

What to do and how to stay safe: Apache Pulsar Manager

• Verify if any internal systems are running Apache Pulsar Manager and identify their network exposure.
• Restrict access to the management interface to trusted administrative IPs only if immediate removal is not possible.
• Replace any Pulsar admin tokens or signing keys that were configured in the retired manager.
• Migrate administrative tasks to the supported alternatives documented in the official Pulsar Administration UI guide.

Step-by-step guide: Patch Management: Why Updates Fail and How to Fix It

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Apache Pulsar Manager are affected?

All versions up to 0.4.0 are affected, with specific authentication bypass issues impacting versions 0.3.0 and later.

Will Apache release a patch for these vulnerabilities?

No, the Apache Pulsar PMC has retired Pulsar Manager and confirmed no further fixes or updates will be made.

How can an attacker exploit this flaw?

An unauthenticated user can create an admin account or force the manager to proxy requests, stealing cluster credentials.