Four Apache Karaf flaws before 4.4.12 enable escalation
Apache Karaf before 4.4.12 has four authorization and path-traversal flaws that can escalate privileges, including remote code execution via jdbc commands; no exploitation is reported.
Apache disclosed four separate vulnerabilities in Apache Karaf before 4.4.12 on 28 September 2026, and none of the reports mention exploitation in the wild. CVE-2026-91012, rated important, is a path traversal in ConfigRepositoryImpl.update that can let a manager write a configuration path outside ${karaf.etc} and escalate to administrator. CVE-2026-91048, rated moderate, is a missing ACL for the jdbc:* shell scope, so any authenticated user, including the viewer role, can run those commands; the advisory says jdbc:ds-create can lead to privilege escalation and remote code execution. CVE-2026-91085, also moderate, is a missing ACL for config:install, and unmatched shell commands fail open in SecuredSessionFactoryImpl.checkSecurity(), allowing escalation to admin. CVE-2026-92142, rated important, is an authorization bypass in JMX MBean lifecycle operations because KarafMBeanServerGuard covers only a fixed method list on the remote JMX connector, enabled by default on ports 1099 and 44444. The four reports do not contradict one another; they describe distinct issues in the same release line.
- Four issues affect Apache Karaf before 4.4.12 and were posted on oss-security on 2026-09-28; none of the reports state in-the-wild exploitation.
- CVE-2026-91012 (important): path traversal in org.apache.karaf.config.core.impl ConfigRepositoryImpl.update builds a config path from caller input that is not confined to ${karaf.etc}, enabling manager-to-admin escalation.
- CVE-2026-91048 (moderate): no org.apache.karaf.command.acl.jdbc.cfg shipped, so any authenticated shell user, including the viewer role, can run jdbc:*; jdbc:ds-create is described as leading to privilege escalation and remote code…
- CVE-2026-91085 (moderate): config:install has no ACL entry; unmatched shell commands fail open in SecuredSessionFactoryImpl.checkSecurity(), allowing escalation to admin.
- CVE-2026-92142 (important): authorization bypass in JMX MBean lifecycle operations; remote JMX is enabled by default on ports 1099 and 44444, and KarafMBeanServerGuard proxies only a fixed method list.
Coverage timelineoldest first · each row is one article
- · 18d agoCVE-2026-91012: Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
oss-security· 52
CVE-2026-91012 is a path traversal in Apache Karaf that lets managers escalate to administrator.
- · 18d agoCVE-2026-91048: Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create
CVE-2026-91048 lets authenticated Apache Karaf users, including viewers, run jdbc commands and achieve code execution.
Vulnerabilities in this storyAll →
- CVE-2026-910129.8—Apache Karaf config path traversal enables manager-to-admin escalationpublished · Apache Software Foundation Apache Karaf+3 related
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
CVE-2026-91012+3 related CVEs | Apache Karaf config path traversal enables manager-to-admin escalation Apache Karaf's configuration repository writes config files from caller-supplied input without keeping the result inside ${karaf.etc}. A principal who already has the shipped manager role can reach ConfigRepositoryImpl.update or createFactoryConfiguration through the config MBean or config shell commands and cause the process to write attacker-controlled content to any path it can write, including files otherwise reserved for admin such as etc/users.properties, ACL configs, and management configuration. That write can be used to grant admin or otherwise take over the container. An older ".." check on the install path was incomplete and was never applied to these update and factory-create paths. No public proof of concept is known, the issue is not in CISA KEV, and CVSS has not yet been scored. |