CVE-2026-105869

Published 21 October 2026 · tracked since 22 October 2026

Description

Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorization. The provider did not verify the token itself: it parsed th

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-114264 MEDIUM 4.7
• CVE-2026-114265 MEDIUM 6.3
• CVE-2026-114492 MEDIUM 6.5
• CVE-2026-114262 HIGH 7.3
• CVE-2026-114263 HIGH 7.3
• CVE-2026-114128 MEDIUM 6.5
• CVE-2026-105930
• CVE-2026-105926
• CVE-2026-105927
• CVE-2026-76495 HIGH 7.8

→ Open the live CVE board · all tools