EUVD-2026-88661
GHSA-pq4f-45cw-mm5m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation requires an authenticated low-privilege shell session (PR:L) reachable over the network (AV:N) with no user interaction, yielding full RCE impact (C:H/I:H/A:H).
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
8Description PRE-NVD
Articles & Coverage 3
AnalysisAI
Privilege escalation to remote code execution in Apache Karaf before 4.4.12 lets any authenticated shell session - including one holding only the viewer role - execute every jdbc:* and jms:* command, because the command guard (SecuredSessionFactoryImpl) treats commands with no matching ACL rule as permitted and the jdbc/jms ACL configuration files are never shipped. An attacker can use jdbc:ds-create to store a fully controlled JDBC URL into a pax-jdbc-config factory Configuration that is reactively turned into a live DataSource; drivers that act on URL parameters at connect time (for example H2 with INIT=RUNSCRIPT) then execute attacker code, bypassing the admin-role gate that protects shell:exec. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Karaf shell session with at minimum the viewer role (so not unauthenticated despite the supplied PR:N vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) rates this as critical and fully unauthenticated, but this directly conflicts with the description, which states exploitation requires 'any authenticated shell session (including one holding only the viewer role)' - i.e. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Apache Karaf 4.4.12 - upgrade to that version or later, which ships the missing command ACL rule files and closes the default-allow gap for the jdbc and jms scopes; this is the primary and lowest-risk fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Apache Karaf instances and identify any running versions before 4.4.12, confirm whether jdbc/jms commands or shell access are enabled, restrict Karaf shell access to trusted administrators, and review logs for jdbc:ds-create or unexpected JDBC URL configuration changes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. Rated high severity (CVSS 8.1), this vulne
Authenticated path traversal in Apache Karaf before 4.4.12 allows a principal holding the shipped 'manager' role to writ
This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the
Authorization bypass in Apache Karaf before 4.4.12 allows an authenticated JMX client holding any role - including the l
In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the runni
In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available
OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used u
Metaspace exhaustion in Apache Karaf before 4.4.11 allows an operator with access to Karaf's bundle- and feature-managem
Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in
Privilege escalation in Apache Karaf versions before 4.4.12 allows any authenticated user of the shell or SSH console -
In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. Rated medium severity
Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today