Skip to main content

Apache Karaf EUVDEUVD-2026-88660

| CVE-2026-91012 CRITICAL
Path Traversal (CWE-22)
2026-09-28 GHSA-q6wq-m79c-29mj
Apache Path Traversal Red Hat Karaf Apache Karaf
9.8
CVSS 3.1 · Vendor
Share

Severity by source

Vendor (CNA) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

Manager-role authentication is required so PR:L not PR:N; reachable over JMX/SSH network management (AV:N, AC:L), and arbitrary file write enables full container takeover (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat
8.8 HIGH
qualitative

Primary rating from Vendor (CNA).

CVSS VectorVendor

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Analysis Updated
Oct 01, 2026 - 15:29 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Oct 01, 2026 - 15:22 vuln.today
cvss_changed
CVSS changed
Oct 01, 2026 - 15:22 NVD
9.8 (CRITICAL)
Patch available
Sep 29, 2026 - 10:16 EUVD
Metadata Corrected
Sep 28, 2026 - 18:40 vuln.today
tag: Apache Karaf added
Analysis Generated
Sep 28, 2026 - 18:24 vuln.today
CVE Published
Sep 28, 2026 - 16:00 oss-security
CRITICAL

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 3

News 5 New Docker Vulnerabilities - 3 Critical, 2 High Severity Sep 29, 2026 News 9 New Apache Vulnerabilities - 4 Critical, 5 High Severity Sep 29, 2026 News Critical Privilege Escalation in Apache Karaf - CVE-2026-91012 Sep 28, 2026

AnalysisAI

Authenticated path traversal in Apache Karaf before 4.4.12 allows a principal holding the shipped 'manager' role to write attacker-controlled content to arbitrary files writable by the Karaf process, because ConfigRepositoryImpl.update() and createFactoryConfiguration() build the target configuration filename from caller-supplied input without confining the result to ${karaf.etc}. Under Karaf's default command/JMX ACL (org.apache.karaf.command.acl.conf.cfg maps 'update = manager'), this lets a manager-role user overwrite files the same ACL reserves to 'admin' - such as etc/users.properties, etc/*.acl.*.cfg, and etc/org.apache.karaf.management.cfg - and thereby grant themselves the admin role or take over the container. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires an authenticated principal holding the 'manager' role under Karaf's default shipped command/JMX ACL (org.apache.karaf.command.acl.conf.cfg maps 'update = manager'), reached through the config JMX MBean or the config:update/config:* shell commands. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals conflict on exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: Apache Karaf 4.4.12 - the fixed release that closes the affected range 'Apache Karaf 0 < 4.4.12'; upgrade to 4.4.12 or later using the artifacts and instructions at https://karaf.apache.org/ (see also https://lists.apache.org/thread/op8trtz1qxkdwj2rjozhd9yt2yd6nhw4 and the oss-security advisory https://seclists.org/oss-sec/2026/q3/967). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Apache Karaf instances and identify those running versions prior to 4.4.12; verify if any manager-role accounts exist and review their permissions. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Karaf

View all
CVE-2020-28052 HIGH POC
8.1 Dec 18

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. Rated high severity (CVSS 8.1), this vulne
CVE-2026-91048 CRITICAL
9.8 Sep 28

Privilege escalation to remote code execution in Apache Karaf before 4.4.12 lets any authenticated shell session - inclu
CVE-2022-40145 CRITICAL
9.8 Dec 21

This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the

CVE-2026-92142 HIGH
8.8 Sep 28

Authorization bypass in Apache Karaf before 4.4.12 allows an authenticated JMX client holding any role - including the l
CVE-2018-11786 HIGH
8.8 Sep 18

In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the runni
CVE-2018-11787 HIGH
8.1 Sep 18

In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available
CVE-2017-1000406 HIGH
7.5 Nov 30

OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used u
CVE-2026-92230 HIGH
7.5 Sep 17

Metaspace exhaustion in Apache Karaf before 4.4.11 allows an operator with access to Karaf's bundle- and feature-managem
CVE-2019-0191 MEDIUM
6.5 Mar 21

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in

CVE-2026-91085 MEDIUM
6.3 Sep 28

Privilege escalation in Apache Karaf versions before 4.4.12 allows any authenticated user of the shell or SSH console -

CVE-2020-11980 MEDIUM
6.3 Jun 12

In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. Rated medium severity
CVE-2014-0219 MEDIUM
5.5 Nov 15

Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2022-41352 CRITICAL POC
9.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8

Vendor StatusVendor

Share

EUVD-2026-88660 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy