EUVD-2026-88664
GHSA-5rr2-29jr-5v63
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Remote JMX (AV:N), deterministic bypass (AC:L), any authenticated role required (PR:L), no user interaction; MLet loads attacker code in the JVM yielding full C/I/A, scope unchanged.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
5Description PRE-NVD
Articles & Coverage 3
AnalysisAI
Authorization bypass in Apache Karaf before 4.4.12 allows an authenticated JMX client holding any role - including the least-privileged 'viewer' - to evade RBAC and achieve remote code execution inside the Karaf JVM. Karaf's MBeanServer guard never checks the lifecycle operations createMBean, registerMBean and unregisterMBean, so a caller can instantiate and register the standard javax.management.loading.MLet class and then invoke its getMBeansFromURL operation, which the shipped default 'get* = viewer' ACL wildcard inadvertently authorizes, causing attacker-hosted classes to be fetched and loaded as new MBeans. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires network reachability to Karaf's remote JMX connector (RMI registry/server on default ports 1099 and 44444, which are enabled by default) and valid JMX credentials of ANY role, including the least-privileged 'viewer' - so PR:L, not unauthenticated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue despite the absence of a scored CVSS vector, EPSS, KEV, or SSVC data in the input. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to Apache Karaf 4.4.12 (released 27/9/26) or to 4.5.0 once available, as recommended in the advisory at https://seclists.org/oss-sec/2026/q3/970 and the release notes linked from https://karaf.apache.org/; the fix adds createMBean, registerMBean and unregisterMBean to the guarded operation list, resolves their roles by ObjectName and MBean class name, and ships default etc/jmx.acl.cfg rules restricting them to the 'admin' role. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, restrict network access to the remote JMX RMI connector on ports 1099/44444 to only trusted management hosts, and disable remote JMX entirely on Apache Karaf instances where it is not operationally required; if remote JMX must remain enabled, enforce strong unique JMX credentials, rotate them, and alert on any JMX authentication or MBean registration activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. Rated high severity (CVSS 8.1), this vulne
Privilege escalation to remote code execution in Apache Karaf before 4.4.12 lets any authenticated shell session - inclu
Authenticated path traversal in Apache Karaf before 4.4.12 allows a principal holding the shipped 'manager' role to writ
This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the
In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the runni
In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available
OpenDaylight Karaf 0.6.1-Carbon fails to clear the cache after a password change, allowing the old password to be used u
Metaspace exhaustion in Apache Karaf before 4.4.11 allows an operator with access to Karaf's bundle- and feature-managem
Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in
Privilege escalation in Apache Karaf versions before 4.4.12 allows any authenticated user of the shell or SSH console -
In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. Rated medium severity
Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today