dbcve.org
PulsarApplication · Apache

CVE-2021-22160

CRITICAL · 9.8 CVSS v3.1 Published 2021-05-26
Fix available
A fix is available. Upgrade to 2.7.1 or later.
See remediation →
100/100
Remediation priority · Urgent
High EPSS Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Apache Pulsar's JWT authentication bypasses signature verification when a token's algorithm is set to 'none', allowing attackers to forge tokens and authenticate as any user including administrators.

MitigationConfigure Pulsar to reject JWT tokens with 'none' algorithm and ensure signature validation is mandatory; update to patched versions and audit existing credentials.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
PulsarApplication
Affected:< 2.7.1

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check Apache Pulsar installed version
    Run 'pulsar version' or check the pulsar packages installed on the system. Alternatively, inspect the pulsar-home directory or broker logs for the version string.
    Affected if The version is below 2.7.1 (e.g., 2.6.x, 2.5.x, etc.)
  2. Verify JWT authentication is configured
    Examine the broker configuration file (typically broker.conf or standalone.conf) for authentication settings. Look for 'authenticationEnabled=true' and 'authenticationProviders' including 'org.apache.pulsar.broker.authentication.AuthenticationProviderToken'.
    Affected if JWT authentication is enabled as an authentication provider in the broker configuration.
  3. Check if 'none' algorithm is allowed for JWT tokens
    Inspect the broker configuration for JWT/security settings. Look for parameters like 'tokenSecretKey', 'tokenPublicKey', or 'jwt.broker.allowed.algo'. Check if 'none' or an empty algorithm is explicitly permitted or not restricted.
    Affected if The configuration does not enforce a mandatory signature algorithm, or 'none' is explicitly listed as an allowed algorithm for JWT token validation.
  4. Inspect active JWT tokens in the environment
    Review any stored or deployed JWT tokens (in configuration, secrets management, or Kubernetes secrets if applicable) and decode them to inspect the header. Look for '"alg":"none"' in the token header.
    Affected if Any active JWT token has 'alg' set to 'none' in its header, indicating it was crafted to bypass signature verification.

You are affected if Apache Pulsar is running a version below 2.7.1, JWT authentication is enabled, and the broker does not reject tokens with the 'none' algorithm, allowing potential forged administrative tokens.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 2.7.1 or later
Fixed in 2.7.1
Interim mitigation

Configure Pulsar to reject JWT tokens with 'none' algorithm and ensure signature validation is mandatory; update to patched versions and audit existing credentials.

Recommended fix High confidence

Apache Pulsar 2.7.1 or later

  1. 1. Backup your current Pulsar configuration and data directories
  2. 2. Stop all Pulsar services (broker, bookie, zookeeper, etc.)
  3. 3. Upgrade Pulsar components to version 2.7.1 or later
  4. 4. Review authentication configuration to ensure JWT settings are correct
  5. 5. Start Pulsar services in the correct order (zookeeper first, then bookie, then broker)
  6. 6. Verify JWT authentication is working properly
  7. 7. Test that tokens with invalid signatures or 'none' algorithm are rejected
Caveat Review release notes for 2.7.x series for any breaking changes specific to your configuration; standard upgrade precautions apply

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Pulsar Scoped from the published advisory
  • Consultation3.0 h
  • Implementation6.0 h
  • Testing3.0 h
  • Review / QA2.0 h
14.0 hours of engineering $2,490
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,984.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2021-22160 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2021-22160 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data