CVE-2021-41571

mediumpriority · track · 27OT risk · elevatedEPSS 0.017 · 77 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.73% (77th) EPSS

CVSS 4 · medium

Is it mine?

7 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-27

In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions.

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04mediumAV:N/AC:L/Au:S/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 8 · impact 2.9

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 3.6

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · OSV

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-863USCWE-863US

affected products (7)

Products and version ranges known to be affected.

Apache Software Foundation Apache Pulsar≤ Apache Pulsar ≤2.8.0enisa_euvdEU
apache pulsar2.6.0 → 2.6.4nvdUScpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*
apache pulsar2.7.0 → 2.7.3nvdUScpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*
apache pulsar= 2.8.0nvdUScpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*
Maven org.apache.pulsar:pulsar≤ 2.6.4osvUSpkg:maven/org.apache.pulsar/pulsar
Maven org.apache.pulsar:pulsar2.7.0 → 2.7.4osvUSpkg:maven/org.apache.pulsar/pulsar
Maven org.apache.pulsar:pulsar2.8.0 → 2.8.1osvUSpkg:maven/org.apache.pulsar/pulsar

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-3whx-qrj5-hh2hImproper Input Validation in Apache Pulsar2022-02-02ghsa · osvUS
In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2022-02-01modified 2026-06-17

references (11)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan