Apache Karaf before 4.4.12 has two authorization flaws
Apache Karaf before 4.4.12 has a moderate shell ACL escalation and an important JMX authorization bypass; no exploitation is reported.
Two authorization issues in Apache Karaf before 4.4.12 were disclosed on 28 September 2026. CVE-2026-91085, rated moderate, stems from a missing ACL entry for config:install: unmatched shell commands fail open in SecuredSessionFactoryImpl.checkSecurity(), so a user can escalate to administrator. CVE-2026-92142, rated important, is an authorization bypass in JMX MBean lifecycle operations. KarafMBeanServerGuard is intended to enforce role-based access on the remote JMX connector, which is on by default on ports 1099 and 44444, but the guard proxy forwards only a fixed method list and some lifecycle calls are not covered. The sources do not disagree, and neither reports active exploitation.
- CVE-2026-91085, rated moderate, affects Apache Karaf before 4.4.12.
- Shell and SSH security relies on per-scope ACL files under etc/; when no rule matches, SecuredSessionFactoryImpl.checkSecurity() fails open.
- config:install has no ACL entry, allowing privilege escalation to administrator.
- CVE-2026-92142, rated important, is an authorization bypass in JMX MBean lifecycle operations in Apache Karaf before 4.4.12.
- Remote JMX is enabled by default on ports 1099 and 44444; KarafMBeanServerGuard proxies only a fixed list of MBeanServer operations.
- Neither report states that either flaw has been exploited.
Coverage timelineoldest first · each row is one article
- · 18d agoCVE-2026-91085: Apache Karaf: config:install missing ACL entry allows privilege escalation to admin
oss-security· 48
Missing config:install ACL in Apache Karaf before 4.4.12 allows escalation to admin.
- · 18d agoCVE-2026-92142: Apache Karaf: Authorization bypass in JMX MBean lifecycle operations
Apache Karaf before 4.4.12 has an authorization bypass in JMX MBean lifecycle operations.
Vulnerabilities in this storyAll →
- CVE-2026-921428.8—JMX Authorization Bypass Enables RCE in Apache Karafpublished · Apache Software Foundation Karaf+1 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
CVE-2026-92142+1 related CVE | JMX Authorization Bypass Enables RCE in Apache Karaf Apache Karaf’s remote JMX connector, enabled by default, protects the MBean server with a role check that only covers a fixed list of operations and skips MBean lifecycle calls such as create, register, and unregister. Any authenticated JMX user, including one limited to the least-privileged viewer role, can therefore create and later remove MBeans with no authorization decision and no audit log entry. On a default ACL, that same viewer role is also allowed to call a JDK MLet method whose name matches the get* wildcard, so the JVM can fetch and register classes from an attacker-controlled URL and execute them. The issue affects Apache Karaf deployments that expose this JMX endpoint; the supplied data does not name affected or fixed version ranges. No public proof of concept is known, and the CVE is not listed in CISA KEV. |