CVE-2026-91012
UnknownSummary
A vulnerability in Apache Karaf allows a user with the "manager" role to write arbitrary content to any file the Karaf process can write to. This is achieved by bypassing path checks in ConfigRepositoryImpl.update() and createFactoryConfiguration(), where the felix.fileinstall.filename value or a PID with ".." segments can point outside the ${karaf.etc} directory.
Risk Assessment
A manager-role user can escalate privileges to admin by modifying files such as etc/users.properties or other ACL files, leading to full container takeover.
Recommendation
Apply available patches or updates to Apache Karaf that address this vulnerability. Additionally, limit trust in manager-role users and monitor logs for unusual configuration write operations.
Other vulnerabilities in Apache Karaf
See all- CVE-2026-92142Unknown
Apache Karaf has a vulnerability in JMX MBeanServer security, where createMBean, registerMBean, and unregisterMBean operations are not subject to RBAC. This allows a user with the 'viewer' role to achieve remote code execution in the Karaf JVM by using MLet as a remote classloader.
- CVE-2026-91085Unknown
Apache Karaf's config:install command is not covered by any ACL rule and is therefore allowed for any authenticated user, including one with only the viewer role. The command fetches a file from an arbitrary URL and writes it into karaf.etc, which contains security-relevant files such as users.properties, keys.properties, host.key, and all ACL configuration files. With the --override flag, existing files can be overwritten, and Felix FileInstall automatically reloads changed .cfg files without requiring a restart.
- CVE-2026-91048Unknown
A vulnerability in Apache Karaf is due to the lack of an ACL configuration file for jdbc and jms commands, allowing any authenticated shell session (even with the viewer role) to execute all jdbc:* and jms:* commands. The jdbc:ds-create command allows storing an arbitrary JDBC URL, which can lead to code execution at the connection level, bypassing the admin role gate.
- CVE-2026-91006Unknown
Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into that string unquoted, allowing shell metacharacters (;, |, `, $(...)) to be interpreted by the shell, leading to arbitrary OS command execution as the Karaf process user.
- CVE-2026-92230High
Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, update, or refresh operations can leave successive bundle ClassLoader's pinned in memory and unreachable for garbage collection, leading to unbounded Metaspace growth and eventual denial of service of the Karaf instance.
Original NVD description (English source)
org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside ${karaf.etc}: * if the submitted property map contains a felix.fileinstall.filename entry, that value is turned directly into a File (getCfgFileFromProperty), so it can point to any absolute path the Karaf process can write to; * otherwise the configuration PID is concatenated verbatim into the target file name (generateConfigFilename(): new File(karaf.etc, pid + ".cfg")), so a PID containing ".." segments resolves outside ${karaf.etc}. createFactoryConfiguration() has the same issue via the factory PID/alias. Both code paths are reachable by any caller holding the "manager" role under Karaf's shipped command/JMX ACL (org.apache.karaf.command.acl.conf.cfg: "update = manager"). Such a user can therefore write attacker-controlled content to any file the Karaf process can write, including files the same ACL otherwise reserves to "admin" (etc/users.properties, etc/*.acl.*.cfg, etc/org.apache.karaf.management.cfg, and similar), allowing a manager-role user to grant themselves the admin role or otherwise take over the container. ConfigMBeanImpl.install() and the config:install shell command already guarded the equivalent risk on their own code path with a finalname.contains("..") string check, but that check does not stop absolute paths or symlink-based escapes, and it was never applied to ConfigRepositoryImpl.update() / createFactoryConfiguration() at all.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS