← Vulnerability feed

Vulnerability record · CVE-2023-30428 · published 12 July 2023

CVE-2023-30428: Apache pulsar incorrect authorization vulnerability

Apache · Pulsar

Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to produce a message to any topic using the broker's admin role. This issue affects Apache Pulsar Brokers: from 2.9.0 through 2.9.5, from 2.10.0 before 2.10.4, 2.11.0. The vulnerability is exploitable when an attacker can connect directly to the Pulsar Broker. If an attacker is connecting through the Pulsar Proxy, there is no known way to exploit this authorization vulnerability. There are two known risks for affected users. First, an attacker could produce garbage messages to any topic in the cluster. Second, an attacker could produce messages to the topic level policies topic for other tenants and influence topic settings that could lead to exfiltration and/or deletion of messages for other tenants. 2.8 Pulsar Broker users and earlier are unaffected. 2.9 Pulsar Broker users should upgrade to one of the patched versions. 2.10 Pulsar Broker users should upgrade to at least 2.10.4. 2.11 Pulsar Broker users should upgrade to at least 2.11.1. 3.0 Pulsar Broker users are unaffected.

8.1 CVSS 3.1 High EPSS 0.82% · top 44.5% CWE-863 · Incorrect authorization
8.1CVSS 3.1 base score
0.82%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to produce a message to any topic using the broker's admin role. This issue affects Apache Pulsar Brokers: from 2.9.0 through 2.9.5, from 2.10.0 before 2.10.4, 2.11.0. The vulnerability is exploitable when an attacker can connect directly to the Pulsar Broker. If an attacker is connecting through the Pulsar Proxy, there is no known way to exploit this authorization vulnerability. There are two known risks for affected users. First, an attacker could produce garbage messages to any topic in the cluster. Second, an attacker could produce messages to the topic level policies topic for other tenants and influence topic settings that could lead to exfiltration and/or deletion of messages for other tenants. 2.8 Pulsar Broker users and earlier are unaffected. 2.9 Pulsar Broker users should upgrade to one of the patched versions. 2.10 Pulsar Broker users should upgrade to at least 2.10.4. 2.11 Pulsar Broker users should upgrade to at least 2.11.1. 3.0 Pulsar Broker users are unaffected.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://lists.apache.org/thread/v39hqtgrmyxr85rmofwvgrktnflbq3q5 Mailing ListVendor Advisory
https://lists.apache.org/thread/v39hqtgrmyxr85rmofwvgrktnflbq3q5 Mailing ListVendor Advisory

Track CVE-2023-30428 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2024-27135Apache pulsar improper input validation vulnerabilityImproper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function w…EPSS 6.0%9.9CVE-2024-27317Apache Pulsar Functions Worker zip extraction path traversalAuthenticated users can upload function jar or nar files to the Pulsar Functions Worker, which extracts them as zip archives without validating filen…EPSS 57%analysed9.8CVE-2021-22160Apache Pulsar JWT authentication bypass via alg=noneApache Pulsar, when configured to authenticate clients with JWT-based tokens, fails to validate the token signature if the presented token declares t…EPSS 53%analysed8.8CVE-2024-27894Apache pulsar improper input validation vulnerabilityThe Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referen…EPSS 1.9%8.8CVE-2023-30429Apache pulsar incorrect authorization vulnerabilityIncorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar. This issue affects Apache Pulsar: before 2.10.4, and 2.11.0. When …EPSS 1.0%8.2CVE-2022-34321Apache pulsar missing authentication for critical function vulnerabilityImproper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The v…EPSS 1.8%8.1CVE-2022-33684Apache pulsar improper certificate validation vulnerabilityThe Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllo…EPSS 0.74%7.5CVE-2023-37544Apache pulsar improper authentication vulnerabilityImproper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication…EPSS 1.4%

Source: NIST National Vulnerability Database (record CVE-2023-30428), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.