CVE-2026-91048

A flaw was found in Apache Karaf. Missing access control list ACL configurations for certain shell command scopes allow authenticated users with low privileges to execute administrative commands. By supplying a crafted database connection string to an unrestricted command, an attacker can trigger...