CVE-2026-105931 — Apache Pulsar: Missing authorization on transaction administration endpoints exposes transaction coordinator and transaction data

Apache Pulsar’s transaction administration REST API read endpoints do not properly verify access to the tenant, namespace, or topic. Consequently, any authenticated user, including one with no permissions, can read transaction-related metadata and statistics belonging to other tenants.