-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the Pulsar Function Worker using the proxy's mTLS-authenticated role for authorization instead of the client's role. The primary suspect is the authentication/authorization flow in the Function Worker's REST API handlers (e.g., FunctionApiV3Resource), where the system would normally extract client credentials but instead inherits the proxy's identity. The PulsarAuthorizationProvider class is also implicated as it handles permission checks, and a failure to properly resolve the client's identity in this context would lead to privilege escalation. Confidence is high for the first function due to its direct role in handling client authentication, and medium for the second due to its general authorization responsibilities.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.pulsar:pulsar | maven | < 2.10.4 | 2.10.4 |
| org.apache.pulsar:pulsar | maven | = 2.11.0 | 2.11.1 |