CVE-2021-41571

    Dashboard / Vulnerabilities / CVE-2021-41571

    CVE-2021-41571

    Published: 1 Feb 2022Last Modified: 9 Jul 2026

    Summary:

    Details: In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions.

    References: https://lists.apache.org/thread/8n3k7pvyh4cf9q2jfzb6pb32ync6xlvr, https://github.com/apache/pulsar/issues/11814, https://pulsar.apache.org/admin-rest-api/#operation/getLastMessageId

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 653ef409e5a3e72d7a7917d45b54c46e7bff5c16
    Fixed -28f141d968b6ccccaf22ab6f8882ae7d22007199

    Affected versions

    2.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-41571 | CVE-DB