External risk intelligence

Apache Pulsar Manager Unauthenticated Administrator Account Creation and API Proxy Abuse

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-105944

Apache Pulsar Manager is a web console designed for cluster administration. Web consoles and management interfaces are commonly deployed as network-accessible services to facilitate remote oversight and management of clusters, making them likely to be reachable via internal or external network paths in typical deployment scenarios.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns security vulnerabilities in Apache Pulsar Manager, a web console used for administering Pulsar clusters. The issues allow unauthenticated users to gain administrative control over the manager and potentially interact with the underlying Pulsar cluster using its credentials. As Apache Pulsar Manager is no longer maintained or supported, organizations should confirm if they are using this software.

Unauthenticated users can gain admin access.
It impacts cluster administration and data.
Confirm usage; it is an unsupported product.

Attack Path

How an attacker could exploit the issue

An attacker could exploit Apache Pulsar Manager by first reaching its web console over the network. Depending on the configuration, an unauthenticated user could potentially create a new administrator account or send requests to the underlying Pulsar cluster using the manager's credentials, leading to a compromise of the cluster. The vulnerability can also allow an attacker to direct the manager to send its cluster credentials to an attacker-controlled host.

Accessible over the network without authentication.
Unauthenticated requests to the admin API.
Full control of Pulsar Manager and cluster.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated user could gain administrative control of Apache Pulsar Manager, allowing them to perform any operation supported by the Pulsar admin API. This could also lead to the exposure of the credential used by Pulsar Manager to interact with the Pulsar cluster.

Administrative control over Pulsar Manager.
Unauthenticated network access to Pulsar Manager.
Full compromise of the Pulsar cluster.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that Apache Pulsar Manager is unsupported and unmaintained, the primary responsibility falls to teams managing the Pulsar infrastructure and any teams that previously operated Pulsar Manager. The immediate action should be to identify all instances of Pulsar Manager, assess their network exposure and criticality, and then initiate a plan to decommission them or migrate to a supported alternative.

Infrastructure or Platform Teams
Verify Pulsar Manager's network reachability.
Decommission unsupported instances promptly.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Apache Pulsar Manager?

Apache Pulsar Manager is a web-based administrative console designed to simplify the management of Apache Pulsar messaging clusters. It provides a graphical interface for tasks like monitoring cluster health, managing topics, and configuring namespaces. Because it serves as a central hub for cluster oversight, it is often granted privileged access to the underlying Pulsar infrastructure, allowing it to perform administrative API calls on behalf of authenticated users.

How should I classify the security weakness in CVE-2026-105944?

This vulnerability is primarily a Missing Authentication for Critical Function (CWE-306). Essentially, the software fails to verify the identity of a user before performing highly sensitive actions. In this case, it allows someone to bypass login requirements to create new administrative accounts or force the system to act on their behalf, effectively granting an uninvited user the same level of control as a legitimate cluster administrator.

Do I need to be authenticated to trigger this vulnerability?

No. The core issues described in CVE-2026-105944 do not require any existing user account or credentials. An attacker only needs network reachability to the Pulsar Manager web interface to initiate these actions. Importantly, simply having the interface running is the trigger; these flaws are inherent to how the software handles requests, meaning standard administrative tasks do not protect the system from these unauthorized commands.

Is my organization at risk if Pulsar Manager is internal?

Halo Surface Signal indicates that web consoles like Pulsar Manager are often placed on networks where they are reachable by internal or external users. Even if the service is not exposed to the public internet, it remains vulnerable to any user who can reach the instance over your internal network. Because the software is fundamentally broken regarding authentication, internal accessibility still poses a significant risk to the security of your Pulsar cluster.

What is the recommended first step for teams using this software?

Since Apache Pulsar Manager is retired and receives no further updates or security patches, the only effective response is to plan for its complete removal. Your first step should be to conduct a comprehensive audit to locate all running instances of the console. Once identified, prioritize decommissioning these instances and transitioning your administrative workflows to supported management tools provided by the Apache Pulsar project.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.