CVE-2026-91048

The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg

Risk score: 73/100
CVSS: 9.8 v3.1
Exploit chance (30 days): 0.5%
Published: 29 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the viewer role) could run every jdbc:* command. jdbc:ds-create stores a…
Affected: Apache Karaf
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache Karaf: Amber, patch this week. org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside ${karaf.etc}: if the submitted property map contains a f…

The flaws

CVE-2026-91048: The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg (CVSS 9.8 · EPSS 1%)
CVE-2026-91012: Path traversal (CVSS 9.8 · EPSS 1%)
CVE-2026-91006: OS command injection (CVSS 8.8 · EPSS 1%)
CVE-2026-92142: Missing authorisation can lead to remote code execution (CVSS 8.8 · EPSS 1%)

The fix

Upgrade Apache Karaf: 4.4.12 · 4.5.0 or later on your release line

Who is exposed: Apache Karaf

Where it stands

No known exploitation

Connects to

Same weakness: Missing authorisation (CWE-862). 398 other warnings in 30 days
Same product: Earlier Apache Karaf warnings. 2 in the last 90 days

Why it is Amber

CVSS 9.8 critical
Remotely exploitable without logging in

References

Original description

The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the viewer role) could run every jdbc:* command. jdbc:ds-create stores a fully attacker-controlled JDBC URL into a pax-jdbc-config factory Configuration with no validation. pax-jdbc-config reactively turns that into a live DataSource. Several JDBC drivers run code or SQL at connection time based on URL parameters (e.g. H2 INIT=RUNSCRIPT), so a viewer-level shell user could reach arbitrary code execution, bypassing the admin-role gate that already protects shell:exec. This is a privilege-escalation-to-RCE chain, not merely an "admin misconfiguration". The same applies to jms:* shell commands.

Last activity 29 Sep 2026. Patch Forecast updates every hour.