Zero Pulsar fingerprints, one 10.0 CVSS, and the management console that outlived its product

Two ZoomEye queries for this article returned nothing. app="Apache Pulsar" matched 0 assets at 05:44 UTC on 22 October 2026, and http.title="Pulsar Manager" matched 0 as well. The advisory set published the day before contains a CVSS 10.0 flaw in Pulsar Manager. The two facts fit together once it is clear that the highest-scored component in the batch is a tool nobody is supposed to be running.

The zero results, with their limits

First, what zero means here. Apache Pulsar is a messaging and streaming platform deployed inside an organisation's own infrastructure. Its broker ports are rarely exposed to the public internet, and its fingerprint coverage depends on whether ZoomEye has an application identifier for the build. A zero does not prove that no Pulsar cluster is internet-visible. It does mean the tested query found nothing in the indexed population at that time.
Second, the comparison carries more information than the zero. In the same session, app="Apache bRPC" returned 5,197 and app="Node.js" returned 5,522,163. Framework-level fingerprints vary enormously in coverage, and a single zero tells you more about the query than about the world.
That caveat explains why the 10.0 score still deserves attention despite the measurement. The vulnerable component is an optional management interface, which means the exposure question is about a console, not a broker.

What Apache disclosed

The Apache Software Foundation disclosed 17 flaws on 21 October 2026: 13 in Pulsar and four in IoTDB. Two are critical, four high, four medium, three low and four unrated. No active exploitation has been confirmed, and no public proof of concept exists.
The 10.0 entry is CVE-2026-105944 in Pulsar Manager. The initial superuser creation endpoint requires no authentication and remains open after setup. Unauthenticated users can proxy admin API requests or redirect requests to an external host, and in doing so steal the configured Pulsar admin credential. Pulsar Manager is end-of-life, which places the flaw in a maintenance category that no patch cycle resolves.
Decommissioning is the remediation. That is an unusual instruction for a vulnerability round-up, and it is the correct one.

The rest of the Pulsar set

CVE-2026-105869, rated 9.2, affects MultiRolesTokenAuthorizationProvider when anonymousUserRole is configured. When an HTTP or WebSocket request fails authentication and falls back to the anonymous role, the provider reads the bearer token from the Authorization header without verifying its cryptographic signature. An unauthenticated attacker can therefore send forged or unsigned JWTs that list superuser roles and gain administrative control.
The remaining entries break tenant isolation in smaller increments:

• CVE-2026-105937, 8.7: missing authorisation of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data.
• CVE-2026-105945, 7.7: improper validation of package name components allows cross-tenant package access in filesystem package storage.
• CVE-2026-105942, 7.7: the original principal of a proxied request is authorised with the proxy's authentication data, allowing privilege escalation.
• CVE-2026-105934, 7.2: missing tenant admin authorisation check when truncating a partitioned topic.
• CVE-2026-105930, 6.0: improper authorisation of function, source and sink package URLs allows cross-tenant package download.
• CVE-2026-105936, 5.3: the functions connectors list endpoint does not apply the super-user check that the worker connectors endpoint applies. The message bus entries are fixed in 4.0.14 and 4.2.5. Apache IoTDB adds four flaws including a root privilege bypass. The reporting describes the IoTDB set as part of the same 17-CVE disclosure but does not enumerate all four CVE identifiers in the material reviewed here.

The pattern that a count cannot show

Read the seven Pulsar entries as a group and one theme repeats: authorisation decisions that are made once and trusted afterwards. A token is read without signature verification because the fallback path assumes the role was already established. A proxied request inherits the proxy's identity. A truncation operation skips the tenant admin check. Each is a boundary that exists in the design and is not enforced at the point of use.
That pattern makes the surrounding configuration more important than the fix versions. anonymousUserRole configured at all is the precondition for CVE-2026-105869. A deployment that never enabled it is not on that path, and no external measurement reports the setting.

An audit sequence for a Pulsar estate

1. Establish whether Pulsar Manager runs anywhere. If it does, decommission it rather than patch it, since the product is end-of-life and the missing superuser-creation check is not a configuration the operator can close.
2. Check whether anonymousUserRole is configured and what roles the fallback path can assume. This is the precondition for the 9.2 flaw.
3. Review tenant boundaries that rely on single authorisation checks: shadow topic sources, package storage and partition truncation.
4. Record the cluster version before and after the upgrade. The fixed versions are 4.0.14 and 4.2.5, and a mixed cluster patches one broker at a time.

What the measurement cannot establish

A zero fingerprint count does not mean an absent cluster. It means the query found no matching asset in the indexed population at 05:44 UTC on 22 October 2026. Pulsar brokers and their adjacent consoles are typically internal, and an internet-wide scanner has no view into them.
That limit does not weaken the advisory. It shifts the evidence to internal discovery, where configuration review answers a question that no exposure count can reach.

References

• SecurityOnline, "Apache Patches 17 Critical and High Flaws in Pulsar and IoTDB", 22 October 2026: https://securityonline.info/apache-pulsar-vulnerabilities-iotdb-patched/
• Apache Pulsar and Pulsar Manager advisories referenced in the reporting, including CVE-2026-105944, CVE-2026-105869, CVE-2026-105930, CVE-2026-105934, CVE-2026-105936, CVE-2026-105937, CVE-2026-105942 and CVE-2026-105945, 21 October 2026.
• ZoomEye search for app="Apache Pulsar", 0 matches, 22 October 2026 05:44 UTC.
• ZoomEye search for http.title="Pulsar Manager", 0 matches, 22 October 2026 05:44 UTC (a zero is a visibility and fingerprint result, not an absence of deployments).