Apache Karaf (Product): news timeline & CVEs

CVE-2026-92142: Apache Karaf: Authorization bypass in JMX MBean lifecycle operations

Apache Karaf before 4.4.12 has an authorization bypass in JMX MBean lifecycle operations.

Apache Karaf before 4.4.12 has an important authorization bypass, CVE-2026-92142, in JMX MBean lifecycle operations. KarafMBeanServerGuard is meant to enforce role-based access control on the remote JMX connector, which is enabled by default on ports 1099 and 44444. The guard is a java.lang.reflect.Proxy that forwards only a fixed list of MBeanServer operations, so some lifecycle calls are not covered. No exploitation is reported.

oss-securitySep 28, 17:11 UTC · 18d agoVulnerability 2 sources CVE-2026-921421

CVE-2026-91085: Apache Karaf: config:install missing ACL entry allows privilege escalation to admin

Missing config:install ACL in Apache Karaf before 4.4.12 allows escalation to admin.

CVE-2026-91085, rated moderate, affects Apache Karaf before 4.4.12. Shell and SSH command security depends on per-scope ACL files under etc/. When no ACL rule matches, SecuredSessionFactoryImpl.checkSecurity() fails open because a NO_MATCH result sets the check to pass. The config:install command has no ACL entry, allowing privilege escalation to admin. No exploitation is reported.

oss-securitySep 28, 17:09 UTC · 18d agoVulnerability 2 sources CVE-2026-91085

CVE-2026-91048: Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create

CVE-2026-91048 lets authenticated Apache Karaf users, including viewers, run jdbc commands and achieve code execution.

Apache disclosed CVE-2026-91048, a missing-authorization flaw in Apache Karaf before 4.4.12, rated moderate. The jdbc shell scope shipped without org.apache.karaf.command.acl.jdbc.cfg, and Karaf treats commands with no matching ACL as allowed. Any authenticated shell session, including one limited to the viewer role, could run every jdbc:* command. The advisory says jdbc:ds-create stores fully attacker-controlled input and can lead to privilege escalation and remote code execution.

oss-securitySep 28, 16:02 UTC · 18d agoVulnerability 2 sources CVE-2026-910481

CVE-2026-91012: Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation

CVE-2026-91012 is a path traversal in Apache Karaf that lets managers escalate to administrator.

Apache disclosed CVE-2026-91012, rated important, in Apache Karaf org.apache.karaf.config.core.impl before 4.4.12. ConfigRepositoryImpl.update, which backs the config MBean and config:* shell commands, builds the configuration file path from caller-supplied input. The result is not checked to remain inside ${karaf.etc}, allowing a path traversal that escalates a manager to administrator. No in-the-wild exploitation is mentioned.

oss-securitySep 28, 16:00 UTC · 18d agoVulnerability 2 sources CVE-2026-910121

CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)

Apache Karaf before 4.4.12 has a moderate command-injection flaw when unsanitized javaOpts launch child instances.

Jean-Baptiste Onofré announced CVE-2026-91006, rated moderate, in Apache Karaf instance.core before 4.4.12. InstanceServiceImpl builds the child JVM command by string concatenation and executes it through /bin/sh on Unix or cscript on Windows. Caller-supplied javaOpts are inserted into that command unquoted. The disclosure does not report exploitation in the wild.

oss-securitySep 28, 11:54 UTC · 18d agoVulnerability 2 sources CVE-2026-91006

CVE-2026-90979: Apache Karaf: LDAP filter injection in JAAS LDAP login modules

Apache Karaf before 4.4.12 has a moderate LDAP filter injection flaw in its JAAS login modules.

Jean-Baptiste Onofré disclosed CVE-2026-90979, rated moderate, in Apache Karaf JAAS LDAP modules before 4.4.12. LDAPCache and LDAPBackingEngine build user and role search filters by substituting %u, %dn, and %fqdn into administrator-configured userFilter and roleFilter templates. Those values come from the login name, the resolved user DN, and its fully qualified namespace form. The post does not describe in-the-wild exploitation.

oss-securitySep 28, 11:52 UTC · 18d agoVulnerability 2 sources CVE-2026-909794

CVE-2026-92230: Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching

Apache Karaf versions before 4.4.11 pin bundle ClassLoaders in memory via static ThreadLocal caching, causing leaks (CVE-2026-92230, moderate).

Apache Karaf's XmlUtils caches XML parser and transformer factories in static ThreadLocal fields on long-lived container threads. Because ThreadLocal values outlive the OSGi bundles that created them, repeated bundle or feature install, update, or refresh operations leave successive bundle ClassLoaders pinned in memory and unreachable for garbage collection. The flaw affects Apache Karaf before 4.4.11 and is rated moderate severity.

oss-securitySep 17, 15:34 UTC · 29d agoVulnerability CVE-2026-92230

Apache Karaf

Timeline7 articles

Related CVEsby mentions

Appears with