OS command injection in Apache Karaf child-instance launch
CVSS 3.1
8.8high
EPSS
—
Published
()
Modified
AI analysis
Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line that starts a child Karaf JVM by string concatenation and runs it through /bin/sh on Unix or cscript on Windows. The caller-supplied javaOpts value is inserted unquoted, so shell metacharacters are executed by the shell instead of being passed to the JVM. Anyone who can call instance:create, instance:start, instance:restart, instance:change-opts, or the matching InstancesMBean JMX operations (createInstance, startInstance, changeJavaOpts, cloneInstance) can run arbitrary OS commands as the Karaf process user. Deployments that expose those commands or JMX to operators who are not fully trusted are affected; the advisory does not list version ranges. No public proof of concept is known and the issue is not in CISA KEV.
What to do: Set karaf.secured.command.compulsory.roles=admin in etc/system.properties, limit which principals can run instance:* commands and InstancesMBean via etc/users.properties, and accept javaOpts only from fully trusted operators. Apply Apache's patched Karaf release when it is published; the advisory data does not name a fixed version.
Affected
Apache Software Foundation Apache Karaf
—
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value containing shell metacharacters (;, |, `, $(...)) is interpreted by the shell instead of being passed to the JVM as an option, giving arbitrary OS command execution as the Karaf process user. Reachable via the shell commands instance:create, instance:start, instance:restart, instance:change-opts, and the equivalent InstanceMBean JMX operations (createInstance, startInstance, changeJavaOpts, cloneInstance). Mitigation * Set karaf.secured.command.compulsory.roles=admin in etc/system.properties to close the fail-open gap for all unconfigured command scopes. * Restrict which principals can reach instance:* commands and InstancesMBean via etc/users.properties role assignments. * Treat javaOpts passed to instance:create/instance:start/instance:change-opts/InstancesMBean as untrusted input only from fully-trusted operators.
Apache Karaf before 4.4.12 has a moderate command-injection flaw when unsanitized javaOpts launch child instances.
Jean-Baptiste Onofré announced CVE-2026-91006, rated moderate, in Apache Karaf instance.core before 4.4.12. InstanceServiceImpl builds the child JVM command by string concatenation and executes it through /bin/sh on Unix or cscript on Windows. Caller-supplied javaOpts are inserted into that command unquoted. The disclosure does not report exploitation in the wild.