CVE-2026-92142: Apache Karaf: Authorization bypass in JMX MBean lifecycle operations

Apache Karaf’s remote JMX connector, enabled by default, protects the MBean server with a role check that only covers a fixed list of operations and skips MBean lifecycle calls such as create, register, and unregister. Any authenticated JMX user, including one limited to the least-privileged viewer role, can therefore create and later remove MBeans with no authorization decision and no audit log entry. On a default ACL, that same viewer role is also allowed to call a JDK MLet method whose name matches the get* wildcard, so the JVM can fetch and register classes from an attacker-controlled URL and execute them. The issue affects Apache Karaf deployments that expose this JMX endpoint; the supplied data does not name affected or fixed version ranges. No public proof of concept is known, and the CVE is not listed in CISA KEV.