CVE-2026-91006
- Source
- https://cve.org/CVERecord?id=CVE-2026-91006
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91006.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-91006
- Published
- 2026-09-28T10:44:32Z
- Modified
- 2026-10-10T02:47:31Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
- Details
-
Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value containing shell metacharacters (;, |, `, $(...)) is interpreted by the shell instead of being passed to the JVM as an option, giving arbitrary OS command execution as the Karaf process user.
Reachable via the shell commands instance:create, instance:start, instance:restart, instance:change-opts, and the equivalent InstanceMBean JMX operations (createInstance, startInstance, changeJavaOpts, cloneInstance).
Mitigation * Set karaf.secured.command.compulsory.roles=admin in etc/system.properties to close the fail-open gap for all unconfigured command scopes.
- Restrict which principals can reach instance:* commands and InstancesMBean via etc/users.properties role assignments.
- Treat javaOpts passed to instance:create/instance:start/instance:change-opts/InstancesMBean as untrusted input only from fully-trusted operators.
- Database specific
{ "cna_assigner": "apache", "cwe_ids": [ "CWE-78" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91006.json", "unresolved_ranges": [ { "extracted_events": [ { "fixed": "4.4.12" } ], "source": "AFFECTED_FIELD" } ] }- References
Affected packages
Git / github.com/apache/karaf
Affected ranges
- Type
- GIT
- Repo
- https://github.com/apache/karaf
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "0" }, { "fixed": "4.4.12" } ], "source": "CPE_RANGE" }