{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aapachepulsar_manager/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:pulsar_manager:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-105944"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Pulsar Manager"],"_cs_severities":["high"],"_cs_tags":["vulnerability","eol","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eThe Apache Pulsar PMC has confirmed that Apache Pulsar Manager suffers from missing authentication and authorization, resulting in the potential exposure of Pulsar administrative credentials (CVE-2026-105944). Apache Pulsar Manager has reached its end-of-life (EOL) and has been retired; consequently, the Apache Pulsar PMC has explicitly stated that no security patches will be issued for this vulnerability. Users are advised to discontinue the use of this software and migrate to alternative solutions.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to bypass security controls and gain access to sensitive administrative credentials, which could lead to full compromise of the Pulsar cluster management interface.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of Apache Pulsar Manager within the environment via software asset inventory.\u003c/li\u003e\n\u003cli\u003ePlan and execute an immediate migration away from Apache Pulsar Manager as the software is EOL and will remain vulnerable.\u003c/li\u003e\n\u003cli\u003eRestrict network access to any remaining instances of Pulsar Manager as an interim compensating control to prevent unauthorized access.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T21:36:00Z","date_published":"2026-10-21T21:36:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-pulsar-manager-eol/","summary":"Apache Pulsar Manager is vulnerable to missing authentication and authorization, leading to potential administrative credential disclosure, and will not receive patches due to the project reaching end-of-life status.","title":"Apache Pulsar Manager: Missing authentication and administrative credential disclosure (CVE-2026-105944)","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-pulsar-manager-eol/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:apache:pulsar_manager:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}