PatchTheCEVCVE-2026-105869: Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of i
48
This month
CRITICAL 9.2REMOTEWATCHLIST
CVE-2026-105869 is a critical-severity flaw (CVSS 9.2) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed the token's claims with the signature removed and trusted that authentication had already checked it. When authentication and authorization are enabled
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.2 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 78%) |
| CISA exploited list | No |
| Weakness | CWE-347 |
| Published | 2026-10-21 |
| Last modified | 2026-10-22 |
Publisher (CNA): Apache Software Foundation
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Fedora 46 · python-trimesh · FIXED · 5.2.0-1.fc46 · FEDORA-2026-429b4bad4c · source
sudo dnf upgrade --advisory=FEDORA-2026-429b4bad4c
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.