EUVD-2026-88663
GHSA-8g53-m82p-xqf5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Remote console access with valid low-privilege credentials (PR:L) over network (AV:N), no user interaction; escalation to admin plus arbitrary security-file overwrite yields full C/I/A impact.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
5Description PRE-NVD
Articles & Coverage 2
AnalysisAI
Privilege escalation in Apache Karaf versions before 4.4.12 allows any authenticated user of the shell or SSH console - including one holding only the low-privilege 'viewer' role - to abuse the config:install command and write attacker-controlled content into the sensitive ${karaf.etc} directory, escalating to full administrative control of the runtime. The flaw exists because config:install has no entry in the shipped etc/org.apache.karaf.command.acl.config.cfg ACL while unmatched commands fail open, and because karaf.secured.command.compulsory.roles ships commented out in etc/system.properties; with the -o/--override flag an existing file such as users.properties, keys.properties or host.key can be overwritten, and Felix FileInstall (felix.fileinstall.dir=${karaf.etc}) hot-reloads any dropped .cfg file without a restart. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account with access to the Karaf shell or SSH console holding any role, including the low-privilege 'viewer' role. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | No CVSS vector, EPSS score, KEV entry, or public POC is provided for CVE-2026-91085, so quantitative signals are entirely absent and the vendor rates it only 'moderate'. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Apache Karaf 4.4.12, which is the vendor-released fix per the 27/9/26 maintenance release announcement at https://karaf.apache.org/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache Karaf instances and identify any running versions before 4.4.12; restrict network and account access to the Karaf shell and SSH console to the minimum necessary administrators, remove or disable the config:install command for low-privilege roles by adding an explicit deny or exclusion in etc/org.apache.karaf.command.acl.config.cfg, uncomment and set karaf.secured.command.compulsory.roles in etc/system.properties so unmatched commands do not fail open, and enable file integrity monitoring on ${karaf.etc} with alerts for changes to users.properties, keys.properties, host.key, and new .cfg files. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. Rated high severity (CVSS 8.1), this vulne
Privilege escalation to remote code execution in Apache Karaf before 4.4.12 lets any authenticated shell session - inclu
Authenticated path traversal in Apache Karaf before 4.4.12 allows a principal holding the shipped 'manager' role to writ
This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the
Authorization bypass in Apache Karaf before 4.4.12 allows an authenticated JMX client holding any role - including the l
In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the runni
In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available
OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used u
Metaspace exhaustion in Apache Karaf before 4.4.11 allows an operator with access to Karaf's bundle- and feature-managem
Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in
In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. Rated medium severity
Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today