Pulsar Manager - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pulsar-manager/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 21 Oct 2026 21:36:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgApache Pulsar Manager: Missing authentication and administrative credential disclosure (CVE-2026-105944)https://feed.craftedsignal.io/briefs/2026-10-apache-pulsar-manager-eol/Wed, 21 Oct 2026 21:36:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-apache-pulsar-manager-eol/Apache Pulsar Manager is vulnerable to missing authentication and authorization, leading to potential administrative credential disclosure, and will not receive patches due to the project reaching end-of-life status.The Apache Pulsar PMC has confirmed that Apache Pulsar Manager suffers from missing authentication and authorization, resulting in the potential exposure of Pulsar administrative credentials (CVE-2026-105944). Apache Pulsar Manager has reached its end-of-life (EOL) and has been retired; consequently, the Apache Pulsar PMC has explicitly stated that no security patches will be issued for this vulnerability. Users are advised to discontinue the use of this software and migrate to alternative solutions.

Impact

Successful exploitation allows unauthenticated attackers to bypass security controls and gain access to sensitive administrative credentials, which could lead to full compromise of the Pulsar cluster management interface.

Recommendation

  • Identify all instances of Apache Pulsar Manager within the environment via software asset inventory.
  • Plan and execute an immediate migration away from Apache Pulsar Manager as the software is EOL and will remain vulnerable.
  • Restrict network access to any remaining instances of Pulsar Manager as an interim compensating control to prevent unauthorized access.
]]>highadvisoryvulnerabilityeolauthentication-bypass