PatchTheCEVCVE-2026-105933: Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace b
18
Routine
LOW 2.3WATCHLIST
CVE-2026-105933 is a low-severity flaw (CVSS 2.3) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption_required namespace policy. When this policy is set, the broker rejects messages that are published without encryption. When the broker loads a persistent topic, it reads the namespace policies and the topic-level policies as part of topic initialization. If a step of this initialization fails, for example because
Why this priority
- On your watchlist
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 2.3 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 79%) |
| CISA exploited list | No |
| Weakness | CWE-636 |
| Published | 2026-10-21 |
| Last modified | 2026-10-23 |
Publisher (CNA): Apache Software Foundation
Timeline
- Published CVE record published
- Updated Record last modified
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.