CVE-2018-11788

Summary Apache Karaf is a modern and polymorphic applications container. It's a lightweight, powered, and enterprise ready container powered by OSGi. Apache Karaf is a "product project", providing a complete and turnkey runtime. The runtime is "multi-facets", meaning that you can deploy different...

CVE-2026-92230

A flaw was found in Apache Karaf's XmlUtils. This vulnerability arises from the caching of XML parser and transformer factories in static ThreadLocal fields within long-lived container threads. Repeated operations such as installing, updating, or refreshing OSGi Open Services Gateway initiative...

CVE-2026-92142

A flaw was found in Apache Karaf. The application fails to enforce role-based access control RBAC on lifecycle operations within its remote Java Management Extensions JMX interface. An authenticated attacker with low privileges can invoke unguarded MBean lifecycle operations to register arbitrary...

CVE-2026-91085

A flaw was found in Apache Karaf. This vulnerability allows privilege escalation because the command access control list ACL mechanism permits unmatched commands by default, and no restriction is defined for the configuration installation command. An authenticated user with low privileges can...

CVE-2026-91048

A flaw was found in Apache Karaf. Missing access control list ACL configurations for certain shell command scopes allow authenticated users with low privileges to execute administrative commands. By supplying a crafted database connection string to an unrestricted command, an attacker can trigger...

CVE-2026-90979

A flaw was found in Apache Karaf. When constructing Lightweight Directory Access Protocol LDAP search filters for user and role lookups, the application fails to properly escape special characters in user-supplied input. A remote attacker can exploit this vulnerability by submitting a crafted...

offsec-karaf-exploits

offsec-karaf-exploits Usage: python exploit.py --help Example: python exploit.py --rhost=192.168.0.133 --rport=1337 --lhost=192.168.0.100 --lport=4444 --creds=karaf:karaf Rebuild Payload Setup Felix Framework 1. Create the lib directory mkdir -p ./revshell/lib 2. Download Felix Framework 7.0.5 3...

asf__karaf_CVE-2022-22932_4-3-5

Apache Karaf Apache Karaf is a modulith runtime, supporting several frameworks and programming model REST/API, web, spring boot, .... It provides turnkey features that you can directly leverage without effort, packaged as mutable or immutable application. Overview Hot deployment : Karaf supports...

Apache Karaf Cellar 4.4.8 Remote Code Execution

Apache Karaf Cellar version 4.4.8 contains an unauthenticated cluster-join vulnerability that allows a network-adjacent attacker to publish a bundle event and execute code on cluster nodes. !/usr/bin/env bash Apache Karaf Cellar 4.4.8 Remote Code Execution Vendor: The Apache Software Foundation...

Apache Karaf Cellar 4.4.8 Remote Code Execution

Summary Apache Karaf Cellar is a complete clustering solution for Apache Karaf Container. Cellar can be directly installed on running Karaf Container instances. Description Apache Karaf Cellar suffers from an unauthenticated cluster-join vulnerability leading to remote code execution. The default...

CVE-2026-91012

A flaw was found in Apache Karaf. This vulnerability allows privilege escalation when the configuration service fails to properly restrict file paths to the designated configuration directory. An authenticated user with manager-level permissions can supply directory traversal sequences or absolut...

CVE-2026-91085

Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files etc/org.apache.karaf.command.acl..cfg. SecuredSessionFactoryImpl.checkSecurity resolves the roles required for an invocation and, when no ACL rule matches the command, fails...

CVE-2026-92142

Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control RBAC on MBean operations invoked over the remote JMX connector RMI registry/server, enabled by default on ports 1099 and 44444. The guard is implemented as a...

CVE-2026-91048

The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard SecuredSessionFactoryImpl treats a command with no matching ACL rule as allowed, so any authenticated shell session including one holding only the viewer role could run...

CVE-2026-91012

org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties, which backs the "config" MBean and the config: shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside $karaf.etc: if the submitted property...

EUVD-2026-88664

Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control RBAC on MBean operations invoked over the remote JMX connector RMI registry/server, enabled by default on ports 1099 and 44444. The guard is implemented as a...

CVE-2026-92142 Apache Karaf: Authorization bypass in JMX MBean lifecycle operations

Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control RBAC on MBean operations invoked over the remote JMX connector RMI registry/server, enabled by default on ports 1099 and 44444. The guard is implemented as a...

CVE-2026-92142

Apache Karaf versions prior to 4.4.12 and 4.5.0 are vulnerable to an authorization bypass in the KarafMBeanServerGuard. The guard fails to enforce role-based access control (RBAC) on MBean lifecycle operations: createMBean, registerMBean, and unregisterMBean. These methods are omitted from the gu...

CVE-2026-92142 Apache Karaf: Authorization bypass in JMX MBean lifecycle operations

Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control RBAC on MBean operations invoked over the remote JMX connector RMI registry/server, enabled by default on ports 1099 and 44444. The guard is implemented as a...

CVE-2026-92142 Apache Karaf: Authorization bypass in JMX MBean lifecycle operations

Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control RBAC on MBean operations invoked over the remote JMX connector RMI registry/server, enabled by default on ports 1099 and 44444. The guard is implemented as a...