Cyber ·
Apache Pulsar Manager: CVE-2026-105944 without authentication and end of life with no fix
Apache Pulsar PMC advisory on Apache Pulsar Manager: missing authentication and authorization, disclosure of administrator credentials, and discontinuation with issues that will not be fixed.
On 21 October 2026, Lari Hotari posted to the oss-sec list an automatic translation of a security advisory from the Apache Pulsar PMC. The advisory concerns Apache Pulsar Manager, identified as CVE-2026-105944, and describes three problems: missing authentication and authorization, and disclosure of Pulsar administrator credentials. According to the text, Apache Pulsar Manager has reached end of life and been discontinued, and these issues will not be fixed. The original advisory was announced on the Apache Pulsar user list. To consult the source, search for the identifier CVE-2026-105944 in the 2026 oss-sec archive and on the Apache Pulsar user list. Because the available text is an automatic translation, check the scope, affected versions and recommendations in the original English version before making decisions. This item is a security advisory, not a usage guide for Rota Nacional.