CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)

Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line that starts a child Karaf JVM by string concatenation and runs it through /bin/sh on Unix or cscript on Windows. The caller-supplied javaOpts value is inserted unquoted, so shell metacharacters are executed by the shell instead of being passed to the JVM. Anyone who can call instance:create, instance:start, instance:restart, instance:change-opts, or the matching InstancesMBean JMX operations (createInstance, startInstance, changeJavaOpts, cloneInstance) can run arbitrary OS commands as the Karaf process user. Deployments that expose those commands or JMX to operators who are not fully trusted are affected; the advisory does not list version ranges. No public proof of concept is known and the issue is not in CISA KEV.