What is CVE-2023-30428?

CVE-2023-30428 is a high-severity vulnerability in Apache Pulsar, classified under Incorrect Authorization. CVSS score: 8.2/10. Published 2023-07-12.

How severe is CVE-2023-30428?

High severity. CVSS v3 base score is 8.2 out of 10.

Auth bypass in Apache Pulsar

CVE-2023-30428

Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Broker's Rest Producer allows authenticated user with a custom HTTP header to produce a message to any topic using the broker's admin role. This issue affects Apache Pulsar Brokers: from 2.9.0 through 2.9.5, from 2.10.0 before 2.10.4, 2.11.0. The vulnerability is exploitable when an attacker can connect directly to the Pulsar Broker. If an attacker is connecting through the Pulsar Proxy, there is no known way to exploit this authorization vulnerability. There are two known risks for affected users. First, an attacker could produce garbage messages to any topic in the cluster. Second, an attacker could produce messages to the topic level policies topic for other tenants and influence topic settings that could lead to exfiltration and/or deletion of messages for other tenants. 2.8 Pulsar Broker users and earlier are unaffected. 2.9 Pulsar Broker users should upgrade to one of the patched versions. 2.10 Pulsar Broker users should upgrade to at least 2.10.4. 2.11 Pulsar Broker users should upgrade to at least 2.11.1. 3.0 Pulsar Broker users are unaffected.

Vulnerability class: Broken Access Control

Published 2023-07-12 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 8.2 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N.

EPSS exploit prediction

EPSS: 0.008 (55.5th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 55.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000

Affected products

Apache Pulsar — versions 2.11.0
Apache Software Foundation Pulsar Broker — versions 2.9.0, 2.10.0, 2.11.0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

References

lists.apache.org/thread/v39hqtgrmyxr85rmofwvgrktnflbq3q5 (vendor-advisory, Mailing List, Vendor Advisory)

Frequently asked questions

What is CVE-2023-30428?: CVE-2023-30428 is a high-severity vulnerability in Apache Pulsar, classified under Incorrect Authorization. CVSS score: 8.2/10. Published 2023-07-12.
How severe is CVE-2023-30428?: High severity. CVSS v3 base score is 8.2 out of 10.