CVE-2026-91085: Apache Karaf: config:install missing ACL entry allows privilege escalation to admin

Apache Karaf enforces shell and SSH command security with per-scope ACL files, but when no ACL rule matches a command the check fails open and the command is allowed for any authenticated user. The shipped config command ACL has no entry for config:install, so a user with only the viewer role can run it. config:install downloads a URL and writes the result into the Karaf etc directory, and with override can replace security files such as users, keys, and ACL configuration; Felix FileInstall reloads .cfg files from that directory without a restart, enabling privilege escalation to admin. Other install commands and config:delete are restricted to admin; config:install is the exception. No public proof of concept is known, it is not listed in CISA KEV, and exploitation in the wild is not reported.