CVE-2026-92142

Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control RBAC on MBean operations invoked over the remote JMX connector RMI registry/server, enabled by default on ports 1099 and 44444. The guard is implemented as a...

CVE-2026-92142

Apache Karaf is vulnerable to an authorization bypass in its JMX MBeanServer due to a flaw in the KarafMBeanServerGuard. While the guard enforces role-based access control (RBAC) on certain operations, it fails to include the lifecycle methods createMBean, registerMBean, and unregisterMBean. This...