CVE-2026-41732

Executive Summary

CVE-2026-41732 is a critical authorization bypass vulnerability in the JsonPulsarHeaderMapper component of Spring for Apache Pulsar. The flaw arises from two distinct weaknesses: a prefix-based trust check that inadvertently trusts all subpackages of any trusted package, and a dangerous fallback behavior where an empty trusted-packages configuration trusts all packages instead of applying a safe default allow-list. This allows an attacker to inject malicious type headers that bypass intended package restrictions, potentially leading to remote code execution or data corruption. The vulnerability affects versions 2.0.0 through 2.0.5, 1.2.0 through 1.2.17, and 1.1.0 through 1.1.17. No official patch is currently available, and no public exploit code has been released.

Supply Chain & Package Security

This vulnerability resides in the spring-pulsar Java package, which is distributed via Maven Central. Organizations using Spring for Apache Pulsar should immediately audit their dependency trees for affected versions. The lack of a patch means that supply chain risk is elevated; users must rely on workarounds or custom mitigations until an official fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high CVSS score reflects the ease of exploitation (no authentication required) and the severe impact on confidentiality, integrity, and availability. An attacker can remotely bypass type header validation and potentially execute arbitrary code or manipulate data streams.

Deep Dive & Mechanics

The JsonPulsarHeaderMapper is responsible for mapping JSON type headers in Apache Pulsar messages to Java classes. It uses a trusted-packages configuration to restrict which classes can be deserialized. The vulnerability stems from two design flaws:

1. Prefix-Based Trust Check: The mapper checks if a type header's package name starts with a trusted package prefix. For example, trusting com.example would also trust com.example.malicious because it is a subpackage. This allows an attacker to craft a type header like com.example.malicious.Exploit to bypass restrictions.

2. Empty Trusted-Packages Fallback: When the trusted-packages list is empty (or not configured), the mapper defaults to trusting all packages. This is a dangerous default that completely disables the security mechanism.

An attacker can exploit this by sending a Pulsar message with a malicious __type header pointing to a class under a trusted prefix (or any class if the list is empty). The mapper will then deserialize the message into that class, potentially triggering arbitrary code execution via deserialization gadgets.

Vulnerable vs. Patched Code

Vulnerable Code (prefix check):

public boolean isTrusted(String className) {
    for (String trustedPackage : trustedPackages) {
        if (className.startsWith(trustedPackage)) {
            return true;
        }
    }
    return false;
}

Patched Code (exact match):

public boolean isTrusted(String className) {
    for (String trustedPackage : trustedPackages) {
        if (className.equals(trustedPackage) || className.startsWith(trustedPackage + ".")) {
            return true;
        }
    }
    return false;
}

Vulnerable Code (empty fallback):

public JsonPulsarHeaderMapper(List<String> trustedPackages) {
    this.trustedPackages = trustedPackages != null ? trustedPackages : Collections.emptyList();
}

Patched Code (safe default):

public JsonPulsarHeaderMapper(List<String> trustedPackages) {
    this.trustedPackages = trustedPackages != null && !trustedPackages.isEmpty() ? trustedPackages : Collections.singletonList("com.safe.default");
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Pulsar topic that uses JsonPulsarHeaderMapper.
• Knowledge of a trusted package (e.g., com.example).

Exploitation Steps:

1. Identify a target Pulsar topic.
2. Craft a message with a malicious __type header:

   {
     "__type": "com.example.malicious.Exploit",
     "data": "payload"
   }
   

3. Send the message to the topic.
4. If the class com.example.malicious.Exploit exists on the classpath (e.g., via a gadget chain), it will be deserialized, leading to RCE.

Example Payload (using ysoserial):

java -jar ysoserial.jar CommonsCollections1 'calc.exe' > payload.bin
# Encode payload as Base64 and embed in message

Blue Team

Detection:

• Monitor Pulsar topics for messages with unexpected __type headers.
• Use network monitoring to detect anomalous deserialization patterns.

Mitigation:

• Immediately configure trusted-packages with an explicit allow-list.
• Apply a WAF rule to block messages with suspicious type headers.
• Use a custom deserialization filter (e.g., ObjectInputFilter).

Indicators of Compromise (IOCs)

• Network: Pulsar messages containing __type headers with subpackage names (e.g., com.example.malicious).
• Logs: Deserialization errors or unexpected class loading in Pulsar broker logs.
• File System: Presence of malicious class files or JARs in the classpath.
• Process: Unusual child processes spawned by the Pulsar broker (e.g., calc.exe, bash).

Detection Engineering

YARA Rule

rule Detect_Malicious_Type_Header {
    meta:
        description = "Detects Pulsar messages with suspicious __type headers"
        author = "Valters IT"
        date = "2025-04-14"
    strings:
        $type_header = "__type"
        $subpackage = /[a-zA-Z_][a-zA-Z0-9_]*\.[a-zA-Z_][a-zA-Z0-9_]*\.[a-zA-Z_][a-zA-Z0-9_]*/
    condition:
        $type_header and #subpackage > 1
}

Sigma Rule

title: Pulsar Malicious Type Header Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects Pulsar messages with suspicious __type headers indicating CVE-2026-41732 exploitation
author: Valters IT
logsource:
    category: application
    product: pulsar
detection:
    selection:
        header_name: "__type"
        header_value|contains: "."
    condition: selection
falsepositives:
    - Legitimate use of subpackages in trusted configurations
level: high

Suricata Rule

alert tcp any any -> any 6650 (msg:"CVE-2026-41732 Pulsar Malicious Type Header"; flow:to_server,established; content:"__type"; nocase; pcre:"/__type\":\s*\"[a-zA-Z_][a-zA-Z0-9_]*\.[a-zA-Z_][a-zA-Z0-9_]*\.[a-zA-Z_][a-zA-Z0-9_]*/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Configure Trusted Packages: Set an explicit allow-list in application.properties:

   spring.pulsar.header-mapper.trusted-packages=com.example.allowed,com.other.allowed
   

2. Apply Workaround: If patching is not possible, implement a custom ObjectInputFilter to restrict deserialization:

   ObjectInputFilter filter = ObjectInputFilter.Config.createFilter("com.example.allowed.*;!*");
   ObjectInputFilter.Config.setObjectInputFilter(ois, filter);
   

3. Monitor Logs: Enable debug logging for JsonPulsarHeaderMapper to detect suspicious type headers.

Long-Term Fix:

• Upgrade to a patched version once released (check Spring for Apache Pulsar releases).
• Implement a strict package validation mechanism that uses exact matches or explicit subpackage allow-lists.

Valters IT
Securing Digital Frontiers