Apache Pulsar Manager: Missing authentication and administrative credential disclosure (CVE-2026-105944)

The Apache Pulsar PMC has confirmed that Apache Pulsar Manager suffers from missing authentication and authorization, resulting in the potential exposure of Pulsar administrative credentials (CVE-2026-105944). Apache Pulsar Manager has reached its end-of-life (EOL) and has been retired; consequently, the Apache Pulsar PMC has explicitly stated that no security patches will be issued for this vulnerability. Users are advised to discontinue the use of this software and migrate to alternative solutions.

Impact

Successful exploitation allows unauthenticated attackers to bypass security controls and gain access to sensitive administrative credentials, which could lead to full compromise of the Pulsar cluster management interface.

Recommendation

• Identify all instances of Apache Pulsar Manager within the environment via software asset inventory.
• Plan and execute an immediate migration away from Apache Pulsar Manager as the software is EOL and will remain vulnerable.
• Restrict network access to any remaining instances of Pulsar Manager as an interim compensating control to prevent unauthorized access.