Apache Pulsar
Apache Pulsar is a cloud-native, distributed messaging and streaming platform maintained by the Apache Software Foundation, which acts as a CNA. It is increasingly used as a Kafka alternative in AI data pipelines. CVE history includes authentication bypass vulnerabilities in the WebSocket Proxy and broker authorization issues.
Querying Apache Pulsar
apache_pulsar3.1.0, 2.11.1, 2.10.4curl "https://api.attestd.io/v1/check?product=apache_pulsar&version=2.11.0" \
-H "Authorization: Bearer $ATTESTD_KEY"Pulsar 2.11.0 is affected by CVE-2023-37544 (WebSocket Proxy authentication bypass). Expect risk_state: "critical".
{
"product": "apache_pulsar",
"version": "2.11.0",
"supported": true,
"risk_state": "critical",
"risk_factors": [
"remote_code_execution",
"no_authentication_required",
"internet_exposed_service",
"patch_available"
],
"actively_exploited": false,
"remote_exploitable": true,
"authentication_required": false,
"patch_available": true,
"fixed_version": "3.0.11",
"confidence": 0.5,
"cve_ids": [
"CVE-2022-34321",
"CVE-2023-30428",
"CVE-2023-30429",
"CVE-2023-31007",
"CVE-2023-37544",
"CVE-2023-37579",
"CVE-2023-51437",
"CVE-2024-27135",
"CVE-2024-27317",
"CVE-2024-27894",
"CVE-2024-28098",
"CVE-2024-29834",
"CVE-2025-30677"
],
"cves": null,
"max_epss": 0.56934,
"last_updated": "2026-07-13T05:20:43.547786Z",
"supply_chain": null,
"supply_chain_monitored": false,
"typosquat": null
}Apache Pulsar 3.1.0 has no known relevant vulnerabilities at the time of the last synthesis run.
curl "https://api.attestd.io/v1/check?product=apache_pulsar&version=3.1.0" \
-H "Authorization: Bearer $ATTESTD_KEY"CVE history
Pulsar CVEs concentrate in two areas: authentication bypass in proxy components (WebSocket Proxy, broker topic-level policies) and sensitive data exposure in connection handling. The most severe issues require no credentials to exploit the WebSocket Proxy bypass.
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2023-37544 | Authentication bypass in the WebSocket Proxy component allows unauthenticated clients to consume messages from any topic. | < 2.10.6, < 2.11.2, < 3.0.1 | 9.8 |
CVE-2023-31007 | Authentication bypass allows unauthenticated message consumption from Pulsar brokers when topic-level policies are used. | < 2.10.4, < 2.11.1 | 7.5 |
CVE-2022-33681 | Man-in-the-middle attack via sensitive data exposure in Pulsar SQL connection parameters. | < 2.9.3, < 2.10.1 | 8.8 |