CVE-2026-91048: CWE-862 in Apache Software Foundation Apache Karaf
The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the viewer role) could run every jdbc:* command. jdbc:ds-create stores a fully attacker-controlled JDBC URL into a pax-jdbc-config factory Configuration with no validation. pax-jdbc-config reactively turns that into a live DataSource. Several JDBC drivers run code or SQL at connection time based on URL parameters (e.g. H2 INIT=RUNSCRIPT), so a viewer-level shell user could reach arbitrary code execution, bypassing the admin-role gate that already protects shell:exec. This is a privilege-escalation-to-RCE chain, not merely an "admin misconfiguration". The same applies to jms:* shell commands.
AI Analysis
Technical Summary
Apache Karaf's jdbc shell commands do not have an associated ACL configuration, causing the command guard to allow execution by any authenticated user. This allows users with minimal privileges to run jdbc:* commands, including jdbc:ds-create, which stores attacker-controlled JDBC URLs into pax-jdbc-config without validation. This configuration is then turned into a live DataSource reactively. Since some JDBC drivers execute code or SQL during connection initialization based on URL parameters, this creates a chain from privilege escalation to remote code execution, bypassing the admin-role protections on shell:exec. The vulnerability similarly affects jms:* shell commands.
Potential Impact
An authenticated user with only viewer-level privileges can escalate their privileges to execute arbitrary code on the system running Apache Karaf. This bypasses intended admin-role restrictions and can lead to full system compromise via JDBC driver behaviors that execute code on connection initialization.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated shell access to trusted users only and monitor for suspicious use of jdbc:* and jms:* shell commands.
CVE-2026-91048: CWE-862 in Apache Software Foundation Apache Karaf
Description
The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the viewer role) could run every jdbc:* command. jdbc:ds-create stores a fully attacker-controlled JDBC URL into a pax-jdbc-config factory Configuration with no validation. pax-jdbc-config reactively turns that into a live DataSource. Several JDBC drivers run code or SQL at connection time based on URL parameters (e.g. H2 INIT=RUNSCRIPT), so a viewer-level shell user could reach arbitrary code execution, bypassing the admin-role gate that already protects shell:exec. This is a privilege-escalation-to-RCE chain, not merely an "admin misconfiguration". The same applies to jms:* shell commands.
Affected software
Apache Software Foundation
Apache Karaf
pkg:maven/org.apache.karaf/apache-karafRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Apache Karaf's jdbc shell commands do not have an associated ACL configuration, causing the command guard to allow execution by any authenticated user. This allows users with minimal privileges to run jdbc:* commands, including jdbc:ds-create, which stores attacker-controlled JDBC URLs into pax-jdbc-config without validation. This configuration is then turned into a live DataSource reactively. Since some JDBC drivers execute code or SQL during connection initialization based on URL parameters, this creates a chain from privilege escalation to remote code execution, bypassing the admin-role protections on shell:exec. The vulnerability similarly affects jms:* shell commands.
Potential Impact
An authenticated user with only viewer-level privileges can escalate their privileges to execute arbitrary code on the system running Apache Karaf. This bypasses intended admin-role restrictions and can lead to full system compromise via JDBC driver behaviors that execute code on connection initialization.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated shell access to trusted users only and monitor for suspicious use of jdbc:* and jms:* shell commands.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-09-14T17:14:08.734Z
- State
- PUBLISHED
Threat ID: 6abb7b50f7a7c5410615a712
Added to database: 09/29/2026, 08:48:16 UTC
Last enriched: 09/29/2026, 09:03:14 UTC
Last updated: 09/29/2026, 18:20:13 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.