CVE-2026-91048: Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create
CVE-2026-91048 lets authenticated Apache Karaf users, including viewers, run jdbc commands and achieve code execution.
Apache disclosed CVE-2026-91048, a missing-authorization flaw in Apache Karaf before 4.4.12, rated moderate. The jdbc shell scope shipped without org.apache.karaf.command.acl.jdbc.cfg, and Karaf treats commands with no matching ACL as allowed. Any authenticated shell session, including one limited to the viewer role, could run every jdbc:* command. The advisory says jdbc:ds-create stores fully attacker-controlled input and can lead to privilege escalation and remote code execution.
- Apache Karaf before 4.4.12 shipped no ACL for the jdbc command scope.
- Any authenticated shell user, including the viewer role, could run jdbc:* commands.
- jdbc:ds-create is described as enabling privilege escalation to remote code execution.
- The vendor rates the issue moderate, and no exploitation is reported.
Vulnerabilities mentionedAll →
- CVE-2026-910489.8—Missing ACL on Apache Karaf jdbc shell commands enables RCEpublished · Apache Karaf
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-91048 | Missing ACL on Apache Karaf jdbc shell commands enables RCE Apache Karaf shipped the jdbc shell command scope without an org.apache.karaf.command.acl.jdbc.cfg file, and its command guard allows any command that has no matching ACL rule. Any authenticated shell session, including one limited to the viewer role, can therefore run every jdbc:* command. jdbc:ds-create writes an attacker-controlled JDBC URL into a pax-jdbc-config factory configuration that becomes a live DataSource, and some JDBC drivers execute code or SQL from URL parameters at connection time, producing arbitrary code execution that bypasses the admin-role gate on shell:exec. The same missing authorization applies to jms:* shell commands. No public proof-of-concept is known, the issue is not in CISA KEV, and CVSS has not yet been scored. |
Posted by Jean-Baptiste Onofré on Sep 28 Severity: moderate Affected versions: - Apache Karaf before 4.4.12 Description: The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the viewer role) could run every jdbc:* command. jdbc:ds-create stores a fully attacker-controlled...
This source does not provide full text. Read it at seclists.org.