CVE-2026-41732: Spring for Apache Pulsar Auth Bypass

CVE-2026-41732 Overview

CVE-2026-41732 is an insecure deserialization vulnerability in Spring for Apache Pulsar. The JsonPulsarHeaderMapper component matches type headers against trusted packages using a prefix check. Trusting any package implicitly trusts all of its subpackages. An empty trusted-packages configuration falls back to trusting all packages instead of applying a safe default allow-list. Attackers can leverage these weaknesses to deserialize malicious payloads from message headers. The flaw is classified under [CWE-502] Deserialization of Untrusted Data.

Critical Impact
Successful exploitation can lead to remote code execution, data tampering, and service disruption in applications consuming Pulsar messages with untrusted JSON headers.

Affected Products

Spring for Apache Pulsar 2.0.0 through 2.0.5
Spring for Apache Pulsar 1.2.0 through 1.2.17
Spring for Apache Pulsar 1.1.0 through 1.1.17

Discovery Timeline

2026-06-10 - CVE-2026-41732 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-41732

Vulnerability Analysis

The JsonPulsarHeaderMapper deserializes JSON-encoded message headers into Java types declared in the message itself. To defend against arbitrary class instantiation, Spring for Apache Pulsar consults a configurable trusted-packages allow-list before resolving a header type. The implementation performs a prefix comparison rather than an exact package match. An entry such as com.example therefore matches every subpackage including attacker-influenced ones like com.example.evil. The second flaw compounds the issue: an empty allow-list disables enforcement entirely and trusts every package on the classpath.

This class of vulnerability allows an attacker who can publish messages to a consumed Pulsar topic to supply a __TypeId__ header pointing to any reachable gadget class. The deserializer instantiates the type, invoking constructors, setters, and lifecycle callbacks that can execute attacker-chosen logic.

Root Cause

The root cause is improper validation of trusted package boundaries in JsonPulsarHeaderMapper. Prefix-based matching violates the principle of least privilege for type resolution. The fallback behavior on an empty configuration inverts the expected secure-by-default posture, granting blanket trust instead of denying all.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker capable of producing messages to a topic processed by a vulnerable Spring for Apache Pulsar consumer crafts headers referencing a gadget class within a subpackage of any trusted root, or any package at all when the allow-list is empty. When the consumer reads the message, the mapper resolves and deserializes the malicious type, triggering the gadget chain.

No verified public proof-of-concept is available. See the Spring Security Advisory CVE-2026-41732 for technical details.

Detection Methods for CVE-2026-41732

Indicators of Compromise

Unexpected __TypeId__ or other type-hint headers in Pulsar messages referencing classes outside the application's domain packages.
Consumer application logs showing ClassNotFoundException, JsonMappingException, or reflective instantiation errors tied to JsonPulsarHeaderMapper.
Outbound network connections, child processes, or file writes originating from Pulsar consumer JVMs immediately after message ingestion.

Detection Strategies

Inventory all services using Spring for Apache Pulsar and verify the configured trusted-packages value. Treat empty or wildcard configurations as vulnerable.
Inspect Pulsar broker message metadata for header values referencing serialization gadget classes such as those in org.springframework, com.sun.rowset, or org.apache.commons.collections.
Apply runtime application self-protection or Java agents that flag deserialization of types outside an explicit allow-list.

Monitoring Recommendations

Enable verbose logging on JsonPulsarHeaderMapper to record resolved type names per message.
Forward consumer JVM process telemetry, including child process creation and outbound connections, to a centralized analytics platform for behavioral correlation.
Alert on first-seen class names appearing in type headers and on Pulsar consumers spawning shells, scripting interpreters, or unexpected network sockets.

How to Mitigate CVE-2026-41732

Immediate Actions Required

Upgrade Spring for Apache Pulsar to a fixed release line above 2.0.5, 1.2.17, or 1.1.17 as published in the vendor advisory.
Set an explicit, minimal trusted-packages list containing only the exact application packages required for header deserialization.
Restrict who can publish to Pulsar topics consumed by Spring applications through broker-level authentication and authorization.

Patch Information

Refer to the Spring Security Advisory CVE-2026-41732 for the fixed versions and remediation guidance. The patch replaces prefix-based matching with strict package comparison and removes the unsafe empty-list fallback so missing configuration denies all types by default.

Workarounds

Configure a non-empty, fully qualified trusted-packages allow-list that names every required package explicitly, avoiding wildcards or short prefixes.
Place a message validation interceptor in front of consumers to strip or reject untrusted __TypeId__ and related type headers.
Run Pulsar consumer workloads with reduced JVM privileges and network egress controls to limit the blast radius of any deserialization gadget execution.

bash

# Configuration example: explicit trusted-packages allow-list
spring:
  pulsar:
    consumer:
      json-header-mapper:
        trusted-packages:
          - com.example.app.events
          - com.example.app.headers