CVE-2026-91085: CWE-862 in Apache Software Foundation Apache Karaf
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactoryImpl.checkSecurity() resolves the roles required for an invocation and, when no ACL rule matches the command, fails open: ACLConfigurationParser.Specificity.NO_MATCH sets passCheck = true. The safety valve for this, karaf.secured.command.compulsory.roles, ships commented out in etc/system.properties, so an unmatched command is allowed for any authenticated user. The shipped org.apache.karaf.command.acl.config ACL (assemblies/features/standard/src/main/feature/feature.xml, mirrored into instance/.../etc/org.apache.karaf.command.acl.config.cfg) has no install entry. It restricts delete to admin, restricts edit/property-*/update on the jmx.acl.*, org.apache.karaf.command.acl.* and org.apache.karaf.service.acl.* PIDs to admin, and allows manager for everything else, but config:install was simply unmatched, and therefore allowed for any authenticated user, including one holding only the viewer role. config:install <url> <finalname> fetches url and writes it into ${karaf.etc} as finalname. It calls PathUtils.checkWithin() to block .. traversal outside karaf.etc, but that folder holds every security-relevant file Karaf ships: users.properties, keys.properties, host.key, and all org.apache.karaf.*.acl.* files, including the very ACL file that (mis)governs this command. With -o/--override, an existing file is overwritten with attacker-controlled bytes fetched from an arbitrary URL. Because felix.fileinstall.dir = ${karaf.etc} (etc/config.properties), Felix FileInstall also watches and reloads any .cfg file dropped there, closing the loop without requiring a restart. By contrast, bundle:install, feature:install and kar:install are all admin-only in their own ACLs, and config:delete is admin in this same ACL, config:install was the outlier. MitigationAdd install = admin in etc/org.apache.karaf.command.acl.config.cfg (create the file is absent), and/or set karaf.secured.command.compulsory.roles=admin in etc/system.properties (and restart) to make unmatched commands fail closed by default.
AI Analysis
Technical Summary
Apache Karaf's shell/SSH command security relies on per-scope ACL configuration files. The checkSecurity() method fails open when no ACL rule matches a command, allowing unmatched commands by default. The config:install command is unmatched in the default ACL configuration, permitting any authenticated user, including those with only the viewer role, to fetch arbitrary files from URLs and write them into the karaf.etc directory. This directory contains sensitive security files such as users.properties and ACL files. Because Felix FileInstall watches this directory and reloads configuration files automatically, an attacker can overwrite security-relevant files without restarting the service. Other install commands are restricted to admin roles, making config:install an outlier.
Potential Impact
Any authenticated user can exploit this vulnerability to overwrite critical configuration and security files in the Karaf environment, potentially escalating privileges or compromising the system's security posture. The automatic reload of configuration files by Felix FileInstall means changes take effect immediately without requiring a restart, increasing the risk and impact of exploitation.
Mitigation Recommendations
Mitigation involves adding 'install = admin' to the etc/org.apache.karaf.command.acl.config.cfg file (creating it if absent) to restrict the config:install command to admin users. Alternatively, setting 'karaf.secured.command.compulsory.roles=admin' in etc/system.properties and restarting Karaf will cause unmatched commands to fail closed by default, preventing unauthorized access. These mitigations effectively close the access control gap without requiring other changes.
CVE-2026-91085: CWE-862 in Apache Software Foundation Apache Karaf
Description
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactoryImpl.checkSecurity() resolves the roles required for an invocation and, when no ACL rule matches the command, fails open: ACLConfigurationParser.Specificity.NO_MATCH sets passCheck = true. The safety valve for this, karaf.secured.command.compulsory.roles, ships commented out in etc/system.properties, so an unmatched command is allowed for any authenticated user. The shipped org.apache.karaf.command.acl.config ACL (assemblies/features/standard/src/main/feature/feature.xml, mirrored into instance/.../etc/org.apache.karaf.command.acl.config.cfg) has no install entry. It restricts delete to admin, restricts edit/property-*/update on the jmx.acl.*, org.apache.karaf.command.acl.* and org.apache.karaf.service.acl.* PIDs to admin, and allows manager for everything else, but config:install was simply unmatched, and therefore allowed for any authenticated user, including one holding only the viewer role. config:install <url> <finalname> fetches url and writes it into ${karaf.etc} as finalname. It calls PathUtils.checkWithin() to block .. traversal outside karaf.etc, but that folder holds every security-relevant file Karaf ships: users.properties, keys.properties, host.key, and all org.apache.karaf.*.acl.* files, including the very ACL file that (mis)governs this command. With -o/--override, an existing file is overwritten with attacker-controlled bytes fetched from an arbitrary URL. Because felix.fileinstall.dir = ${karaf.etc} (etc/config.properties), Felix FileInstall also watches and reloads any .cfg file dropped there, closing the loop without requiring a restart. By contrast, bundle:install, feature:install and kar:install are all admin-only in their own ACLs, and config:delete is admin in this same ACL, config:install was the outlier. MitigationAdd install = admin in etc/org.apache.karaf.command.acl.config.cfg (create the file is absent), and/or set karaf.secured.command.compulsory.roles=admin in etc/system.properties (and restart) to make unmatched commands fail closed by default.
Affected software
Apache Software Foundation
Apache Karaf
pkg:maven/org.apache.karaf/apache-karafRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Apache Karaf's shell/SSH command security relies on per-scope ACL configuration files. The checkSecurity() method fails open when no ACL rule matches a command, allowing unmatched commands by default. The config:install command is unmatched in the default ACL configuration, permitting any authenticated user, including those with only the viewer role, to fetch arbitrary files from URLs and write them into the karaf.etc directory. This directory contains sensitive security files such as users.properties and ACL files. Because Felix FileInstall watches this directory and reloads configuration files automatically, an attacker can overwrite security-relevant files without restarting the service. Other install commands are restricted to admin roles, making config:install an outlier.
Potential Impact
Any authenticated user can exploit this vulnerability to overwrite critical configuration and security files in the Karaf environment, potentially escalating privileges or compromising the system's security posture. The automatic reload of configuration files by Felix FileInstall means changes take effect immediately without requiring a restart, increasing the risk and impact of exploitation.
Mitigation Recommendations
Mitigation involves adding 'install = admin' to the etc/org.apache.karaf.command.acl.config.cfg file (creating it if absent) to restrict the config:install command to admin users. Alternatively, setting 'karaf.secured.command.compulsory.roles=admin' in etc/system.properties and restarting Karaf will cause unmatched commands to fail closed by default, preventing unauthorized access. These mitigations effectively close the access control gap without requiring other changes.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-09-14T17:55:38.562Z
- State
- PUBLISHED
Threat ID: 6abb7b50f7a7c5410615a713
Added to database: 09/29/2026, 08:48:16 UTC
Last enriched: 09/29/2026, 09:03:06 UTC
Last updated: 09/29/2026, 18:20:13 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.