CVE-2026-91006
Apache Karaf: OS command injection
- Risk score
- 66/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 1.1%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value containing shell met…
- Affected
- Apache Karaf
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Apache Karaf: Amber, patch this week. org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside ${karaf.etc}: if the submitted property map contains a f…
The flaws
- CVE-2026-91006: OS command injection (CVSS 8.8 · EPSS 1%)
- CVE-2026-91012: Path traversal (CVSS 9.8 · EPSS 1%)
- CVE-2026-91048: The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg (CVSS 9.8 · EPSS 1%)
- CVE-2026-92142: Missing authorisation can lead to remote code execution (CVSS 8.8 · EPSS 1%)
The fix
Upgrade Apache Karaf: 4.4.12 · 4.5.0 or later on your release line
Who is exposed: Apache Karaf
Where it stands
- No known exploitation
Connects to
- Same weakness: OS command injection (CWE-78). 308 other warnings in 30 days
- Same product: Earlier Apache Karaf warnings. 2 in the last 90 days
Why it is Amber
- CVSS 8.8 high
References
Original description
Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value containing shell metacharacters (;, |, `, $(...)) is interpreted by the shell instead of being passed to the JVM as an option, giving arbitrary OS command execution as the Karaf process user. Reachable via the shell commands instance:create, instance:start, instance:restart, instance:change-opts, and the equivalent InstanceMBean JMX operations (createInstance, startInstance, changeJavaOpts, cloneInstance). Mitigation * Set karaf.secured.command.compulsory.roles=admin in etc/system.properties to close the fail-open gap for all unconfigured command scopes. * Restrict which principals can reach instance:* commands and InstancesMBean via etc/users.properties role assignments. * Treat javaOpts passed to instance:create/instance:start/instance:change-opts/InstancesMBean as untrusted input only from fully-trusted operators.
Last activity 28 Sep 2026. Patch Forecast updates every hour.