← Vulnerability feed

Vulnerability record · CVE-2022-33682 · published 23 September 2022

CVE-2022-33682: Apache pulsar improper certificate validation vulnerability

Apache · Pulsar

TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle attacks, which could leak credentials, configuration data, message data, and any other data sent by these clients. The vulnerability is for both the pulsar+ssl protocol and HTTPS. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack by providing the client with a cryptographically valid certificate for an unrelated host. This issue affects Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.

5.9 CVSS 3.1 Medium EPSS 0.71% · top 48.3% CWE-295 · Improper certificate validation
5.9CVSS 3.1 base score
0.71%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client leaving intra-cluster connections and geo-replication connections vulnerable to man in the middle attacks, which could leak credentials, configuration data, message data, and any other data sent by these clients. The vulnerability is for both the pulsar+ssl protocol and HTTPS. An attacker can only take advantage of this vulnerability by taking control of a machine 'between' the client and the server. The attacker must then actively manipulate traffic to perform the attack by providing the client with a cryptographically valid certificate for an unrelated host. This issue affects Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.3; 2.9.0 to 2.9.2; 2.10.0; 2.6.4 and earlier.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.apache.org/thread/l0ynfl161qghwfcgbbl8ld9hzbl9t3yx Mailing ListVendor Advisory
https://lists.apache.org/thread/l0ynfl161qghwfcgbbl8ld9hzbl9t3yx Mailing ListVendor Advisory

Track CVE-2022-33682 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2024-27135Apache pulsar improper input validation vulnerabilityImproper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function w…EPSS 6.0%9.9CVE-2024-27317Apache Pulsar Functions Worker zip extraction path traversalAuthenticated users can upload function jar or nar files to the Pulsar Functions Worker, which extracts them as zip archives without validating filen…EPSS 57%analysed9.8CVE-2021-22160Apache Pulsar JWT authentication bypass via alg=noneApache Pulsar, when configured to authenticate clients with JWT-based tokens, fails to validate the token signature if the presented token declares t…EPSS 53%analysed8.8CVE-2024-27894Apache pulsar improper input validation vulnerabilityThe Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referen…EPSS 1.9%8.8CVE-2023-30429Apache pulsar incorrect authorization vulnerabilityIncorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When …EPSS 1.0%8.2CVE-2022-34321Apache pulsar missing authentication for critical function vulnerabilityImproper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The v…EPSS 1.8%8.1CVE-2023-30428Apache pulsar incorrect authorization vulnerabilityIncorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP…EPSS 0.82%8.1CVE-2022-33684Apache pulsar improper certificate validation vulnerabilityThe Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllo…EPSS 0.74%

Source: NIST National Vulnerability Database (record CVE-2022-33682), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.