CVE-2021-22160: Apache Pulsar JWT authentication bypass via alg=none

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required and a complete authentication bypass to admin access, plus a high EPSS score.

What it is

Apache Pulsar, when configured to authenticate clients with JWT-based tokens, fails to validate the token signature if the presented token declares the algorithm "none". An attacker can therefore forge a token and connect to the Pulsar instance as any user, including administrators.

Impact

An attacker gains full authenticated access to the Pulsar instance as an arbitrary identity, including admin, allowing read and write of data and administrative control over the cluster.

Attack surface

Reachable over the network against Pulsar's token-authenticated client interface; no authentication is required because the forged token is accepted, and no user interaction is needed. It only applies where JWT token authentication is enabled.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high at roughly 0.53 (98.9th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Apache Pulsar to a version that validates the JWT signature and rejects the "none" algorithm; consult the Apache Pulsar vendor advisories for the fixed release.
• If immediate patching is not possible, disable JWT token authentication or restrict Pulsar client ports to trusted networks only.
• Rotate any JWT signing keys and tokens that may have been exposed, since forged tokens could have been used undetected.
• Audit Pulsar authentication configuration to confirm which clusters use token-based auth and prioritize those for patching.

Detection

• Search Pulsar broker and authentication logs for tokens with alg set to "none" or for authentication events that succeed without a valid signature.
• Monitor for connections to Pulsar client ports from unexpected source IPs or with unusual user identities, especially admin.
• Alert on administrative actions or topic access performed by accounts that normally do not connect to the cluster.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.