Apache Software Foundation Apache Karaf vulnerabilities

CVE-2026-92142 [HIGH] CWE-862 CVE-2026-92142: Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based a Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX connector (RMI registry/server, enabled by default on ports 1099 and 44444). The guard is implemented as a java.lang.reflect.Proxy around the MBeanServer, and only forwards a fixed lis

CVE-2026-91048 [CRITICAL] CWE-862 CVE-2026-91048: The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the viewer role) could run every jdbc:* command. jdbc:ds-create stores a fully attacker-controlled JDB

CVE-2026-91012 [CRITICAL] CWE-22 CVE-2026-91012: org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "con org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside ${karaf.etc}: * if the submitted property map contains a felix.fileinstall.filename en

CVE-2022-40145 [CRITICAL] CWE-20 CVE-2022-40145: This vulnerable is about a potential code injection when an attacker has control of the target LDAP This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modules.src.main.java.porg.apache.karaf.jass.modules.jdbc.JDBCUtils#doCreateDatasource use InitialContext.lookup(jndiName) without filtering. An user can modify `options.put(JDBCUtils.DATASOURCE, "

CVE-2026-91006 [HIGH] CWE-78 CVE-2026-91006: Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to lau Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value containing shell metacharacters (;, |, `, $(...)) is in

CVE-2018-11788 [CRITICAL] CWE-611 CVE-2018-11788: Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by drop Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external X

CVE-2018-11786 [HIGH] CWE-269 CVE-2018-11786: In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. This can be locked down a bit by using chroot to change the root directory to prot

CVE-2018-11787 [HIGH] CWE-287 CVE-2018-11787: In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Ka In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web browser, and when navigated to it is available at .../s

CVE-2021-41766 [HIGH] CWE-502 CVE-2021-41766: Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Ext Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated deserialization attacks, the implementation used by Apac

CVE-2026-90979 [HIGH] CWE-90 CVE-2026-90979: LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textual LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the login name, the resolved user DN, and its fully qualified namespace form) into administrator-configured filter templates (userFilter, roleFilter). Before the fix, the only sanitization a

CVE-2026-91085 [MEDIUM] CWE-862 CVE-2026-91085: Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org. Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl..cfg). SecuredSessionFactoryImpl.checkSecurity() resolves the roles required for an invocation and, when no ACL rule matches the command, fails open: ACLConfigurationParser.Specificity.NO_MATCH sets passCheck = true. The safet

CVE-2026-92230 [HIGH] CWE-401 CVE-2026-92230: Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, update, or refresh operations can leave successive bundle ClassLoader's pinned in memory and unreachable for garbage coll

CVE-2016-8750 [MEDIUM] CWE-90 CVE-2016-8750: Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.

CVE-2022-22932 [MEDIUM] CWE-22 CVE-2022-22932: Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: https://gitbox.apache.org/repos/asf?p=karaf.git;h=36a2bc4 https://gitbox.apache.org/repos/asf?p=

CVE-2026-24656 [LOW] CWE-502 CVE-2026-24656: Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed. It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS