CVE-2026-91048
UnknownSummary
A vulnerability in Apache Karaf is due to the lack of an ACL configuration file for jdbc and jms commands, allowing any authenticated shell session (even with the viewer role) to execute all jdbc:* and jms:* commands. The jdbc:ds-create command allows storing an arbitrary JDBC URL, which can lead to code execution at the connection level, bypassing the admin role gate.
Risk Assessment
Organizations may be exposed to privilege escalation and remote code execution by users with low privileges. This can lead to full compromise of the Karaf system and associated resources.
Recommendation
It is recommended to immediately configure ACL rules for jdbc:* and jms:* commands and upgrade Apache Karaf to a version containing the security fix.
Other vulnerabilities in Apache Karaf
See all- CVE-2026-92142Unknown
Apache Karaf has a vulnerability in JMX MBeanServer security, where createMBean, registerMBean, and unregisterMBean operations are not subject to RBAC. This allows a user with the 'viewer' role to achieve remote code execution in the Karaf JVM by using MLet as a remote classloader.
- CVE-2026-91085Unknown
Apache Karaf's config:install command is not covered by any ACL rule and is therefore allowed for any authenticated user, including one with only the viewer role. The command fetches a file from an arbitrary URL and writes it into karaf.etc, which contains security-relevant files such as users.properties, keys.properties, host.key, and all ACL configuration files. With the --override flag, existing files can be overwritten, and Felix FileInstall automatically reloads changed .cfg files without requiring a restart.
- CVE-2026-91012Unknown
A vulnerability in Apache Karaf allows a user with the "manager" role to write arbitrary content to any file the Karaf process can write to. This is achieved by bypassing path checks in ConfigRepositoryImpl.update() and createFactoryConfiguration(), where the felix.fileinstall.filename value or a PID with ".." segments can point outside the ${karaf.etc} directory.
- CVE-2026-91006Unknown
Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into that string unquoted, allowing shell metacharacters (;, |, `, $(...)) to be interpreted by the shell, leading to arbitrary OS command execution as the Karaf process user.
- CVE-2026-92230High
Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, update, or refresh operations can leave successive bundle ClassLoader's pinned in memory and unreachable for garbage collection, leading to unbounded Metaspace growth and eventual denial of service of the Karaf instance.
Original NVD description (English source)
The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the viewer role) could run every jdbc:* command. jdbc:ds-create stores a fully attacker-controlled JDBC URL into a pax-jdbc-config factory Configuration with no validation. pax-jdbc-config reactively turns that into a live DataSource. Several JDBC drivers run code or SQL at connection time based on URL parameters (e.g. H2 INIT=RUNSCRIPT), so a viewer-level shell user could reach arbitrary code execution, bypassing the admin-role gate that already protects shell:exec. This is a privilege-escalation-to-RCE chain, not merely an "admin misconfiguration". The same applies to jms:* shell commands.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS