APACHE Software Foundation researchers disclosed 17 security flaws on 21 October 2026, affecting both Apache Pulsar and Apache IoTDB. The majority are Pulsar-related, with 13 vulnerabilities, and four concern IoTDB. The most severe issues include a 10.0 CVSS flaw in Pulsar Manager that is retired, a 9.2 CVSS token bypass in Pulsar, and a root-privilege bypass in IoTDB. Administrators are urged to upgrade and to decommission unsupported management consoles. Current guidance notes that there is no public proof of concept and no confirmed exploitation in the wild for these 17 issues.
Notable CVEs include CVE-2026-105944 (CVSS 10.0) affecting Pulsar Manager; CVE-2026-105869 (CVSS 9.2) involving the MultiRolesTokenAuthorizationProvider mishandling unsigned tokens; and several other Pulsar flaws that break tenant isolation or allow cross-tenant access, such as CVE-2026-105937 (8.7) and CVE-2026-105945 (7.7). IoTDB’s serious issues include CVE-2026-59229, CVE-2026-58663, CVE-2026-59562 and CVE-2026-41114, with the first two enabling root- or privilege-related bypasses and resource misuse.
Affected versions are listed as Pulsar 1.22.0-incubating through just before 4.0.14, and 4.1.0 before 4.2.5; Pulsar Manager releases from 0.1.0 to 0.4.0. IoTDB 2.0.0 before 2.0.11 (and its JDBC driver 1.3.3 before 2.0.11) are impacted.
Mitigation steps include removing Pulsar Manager since it is retired and upgrading Pulsar brokers to 4.0.14 or 4.2.5, with shadow topics now disabled by default unless enableShadowTopics=true. IoTDB installations and JDBC drivers should be upgraded to version 2.0.11. No active exploitation has been confirmed, but administrators should apply the updates promptly.