CVE-2026-92142: Apache Karaf: Authorization bypass in JMX MBean lifecycle operations
Apache Karaf before 4.4.12 has an authorization bypass in JMX MBean lifecycle operations.
Stories per day · 30 days
4 stories, newest first · one card per story
Stories tagged #apache-karaf
CVE-2026-91048: Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create
CVE-2026-91048 lets authenticated Apache Karaf users, including viewers, run jdbc commands and achieve code execution.
CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
Apache Karaf before 4.4.12 has a moderate command-injection flaw when unsanitized javaOpts launch child instances.
CVE-2026-92230: Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching
Apache Karaf versions before 4.4.11 pin bundle ClassLoaders in memory via static ThreadLocal caching, causing leaks (CVE-2026-92230, moderate).