Apache Karaf versions before 4.4.12 have a vulnerability in the JMX MBeanServer access control. The KarafMBeanServerGuard enforces role-based access control (RBAC) on certain MBean operations but omits lifecycle operations like createMBean, registerMBean, and unregisterMBean from checks. This allows any authenticated JMX user, including those with minimal 'viewer' roles, to instantiate and remove arbitrary MBeans without authorization. Exploiting this, an attacker can instantiate the standard JDK MLet MBean to load and execute attacker-controlled classes remotely, leading to remote code execution. The issue is fixed by adding these lifecycle operations to the guarded list and restricting them to the 'admin' role in Apache Karaf 4.4.12 and later.
Apache Karaf versions before 4.4.12 have a security vulnerability where the shell/SSH command ACL enforcement fails open for unmatched commands, allowing any authenticated user to execute certain commands like config:install. This command can fetch and overwrite critical configuration files, potentially leading to privilege escalation. The default configuration does not enforce strict role checks for unmatched commands, increasing risk. Mitigation involves explicitly restricting the install command to admin roles or enabling a setting to fail unmatched commands closed.
CVE-2026-91048 is a critical privilege escalation vulnerability in Apache Karaf affecting versions prior to 4.4.12. The jdbc and jms shell commands lack proper ACL configuration, allowing any authenticated user, including those with only viewer role, to execute all jdbc:* and jms:* commands. This flaw enables an attacker to store a fully controlled JDBC URL that can trigger arbitrary code execution via JDBC driver URL parameters, bypassing admin role restrictions.
CVE-2026-91012 is a critical directory traversal vulnerability in Apache Karaf's configuration management component. It allows users with the 'manager' role to write configuration files to arbitrary locations writable by the Karaf process, bypassing intended access controls. This can lead to privilege escalation by modifying files reserved for the 'admin' role, enabling takeover of the container. The vulnerability arises from insufficient validation of file paths derived from user-supplied input in ConfigRepositoryImpl.update() and createFactoryConfiguration().
CVE-2026-91006 is an OS command injection vulnerability in Apache Karaf's instance-management service. The vulnerability arises because the javaOpts parameter is concatenated into a shell command without proper quoting, allowing shell metacharacters to be interpreted by the OS shell. This can lead to arbitrary command execution with the privileges of the Karaf process user. The flaw is reachable via several Karaf shell commands and JMX operations related to instance management. Mitigations include restricting access to these commands and treating javaOpts as untrusted input unless from fully trusted operators.
CVE-2026-90979 is an LDAP injection vulnerability in Apache Karaf affecting versions before 4.4.12. The issue arises from improper escaping of special characters in LDAP search filters constructed by LDAPCache and LDAPBackingEngine. This can allow crafted input to alter LDAP queries, potentially causing unauthorized role assignments or incorrect user account resolution. The vulnerability is exploitable through certain authentication modules that do not apply proper escaping, such as GSSAPILdapLoginModule and LDAPBackingEngine listRoles. The vulnerability has a high severity score of 7.3.
CVE-2026-92230 is a high-severity vulnerability in Apache Karaf where static ThreadLocal fields cache XML parser/transformer factories on long-lived container threads. This causes memory from successive bundle ClassLoaders to be retained and unreachable for garbage collection after bundle lifecycle operations, leading to unbounded Metaspace growth and potential denial of service.