CVE-2026-91006 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)

Apache Karaf's instance-management service InstanceServiceImpl builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh Unix or cscript Windows. The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value...

CVE-2026-91006

Apache Karaf's instance-management service (InstanceServiceImpl ) is vulnerable to OS Command Injection because it uses string concatenation to build the command line for launching a child Karaf JVM. The javaOpts value provided by the caller is spliced into the command string without being quoted...