Apache Karaf before 4.4.12 has six disclosed flaws

Six Apache Karaf flaws before 4.4.12 cover injection, path traversal, and authorization bypasses, with no reported exploitation.

Jean-Baptiste Onofré disclosed two moderate Apache Karaf flaws on oss-security on 2026-09-28, both affecting versions before 4.4.12. CVE-2026-90979 is an LDAP filter injection in the JAAS LDAP login modules, where LDAPCache and LDAPBackingEngine substitute the login name, resolved user DN, and its fully qualified namespace form into administrator-configured userFilter and roleFilter templates through the placeholders %u, %dn, and %fqdn. CVE-2026-91006 is an OS command injection in instance.core child-instance launch: InstanceServiceImpl builds the child JVM command by concatenation and executes it through /bin/sh on Unix or cscript on Windows, inserting caller-supplied javaOpts unquoted. Apache also disclosed CVE-2026-91012, rated important, a path traversal in ConfigRepositoryImpl.update that is not confined to ${karaf.etc} and lets a manager escalate to administrator, and CVE-2026-91048, rated moderate, in which the jdbc shell scope shipped without an ACL so any authenticated shell user, including the viewer role, can run jdbc:* commands, with jdbc:ds-create described as leading to privilege escalation and remote code execution. Later the same day, CVE-2026-91085, rated moderate, was disclosed because config:install has no ACL entry and unmatched commands fail open in SecuredSessionFactoryImpl.checkSecurity(), allowing escalation to admin, and CVE-2026-92142, rated important, an authorization bypass in JMX MBean lifecycle operations because KarafMBeanServerGuard forwards only a fixed method list while remote JMX is enabled by default on ports 1099 and 44444. None of the disclosures reports in-the-wild exploitation, and the reports do not disagree on affected versions; they assign different severities to different issues.

• Six CVEs affect Apache Karaf before 4.4.12: CVE-2026-90979, CVE-2026-91006, CVE-2026-91012, CVE-2026-91048, CVE-2026-91085, and CVE-2026-92142.
• CVE-2026-90979, rated moderate, is an LDAP filter injection in JAAS LDAP modules; login name, user DN, and namespace form are substituted via %u, %dn, and %fqdn.
• CVE-2026-91006, rated moderate, inserts unsanitized javaOpts into child-instance JVM commands executed through /bin/sh on Unix or cscript on Windows.
• CVE-2026-91012, rated important, is a path traversal in ConfigRepositoryImpl.update not confined to ${karaf.etc}, enabling manager-to-admin escalation.
• CVE-2026-91048, rated moderate, shipped no jdbc ACL, so any authenticated shell user including the viewer role can run jdbc:*; jdbc:ds-create is described as leading to privilege escalation and remote code execution.