Advisories · Technology

Apache Software Foundation Apache Karaf.

Every CVE that names Apache Software Foundation Apache Karaf among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-92142 CVE record

CVSS 8.8 High

Apache Karaf: Authorization bypass in JMX MBean lifecycle operations
- Apache Software Foundation Apache Karaf
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-91085 CVE record

CVSS 6.3 Medium

Apache Karaf: config:install missing ACL entry allows privilege escalation to admin
- Apache Software Foundation Apache Karaf
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-91048 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create
- Apache Software Foundation Apache Karaf
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-91012 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
- Apache Software Foundation Apache Karaf
- Path traversal
Not analysed yet 29 Sept 2026
CVE-2026-91006 CVE record

CVSS 8.8 High

Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
- Apache Software Foundation Apache Karaf
- Command injection
Not analysed yet 28 Sept 2026
CVE-2026-90979 CVE record

CVSS 7.3 High

Apache Karaf: LDAP filter injection in JAAS LDAP login modules
- Apache Software Foundation Apache Karaf
- Other injection
Not analysed yet 28 Sept 2026
CVE-2026-92230 CVE record

CVSS 7.5 High

Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching
- Apache Software Foundation Apache Karaf
- Denial of service
Not analysed yet 17 Sept 2026