CVE-2021-41766 Insecure Java Deserialization in Apache Karaf
Apache Karaf's JMX implementation allows insecure Java deserialization, potentially enabling remote code execution if vulnerable classes are present.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41766?
CVE-2021-41766 is a high-severity unsafe deserialization vulnerability in Apache Karaf, published on 26 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated deserialization attacks, the implementation used by Apache Karaf is not protected against this kind of attack. The impact of Java deserialization vulnerabilities strongly depends on the classes that are available within the targets class path. Generally speaking, deserialization of untrusted data does always represent a high security risk and should be prevented. The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder).
Weakness: CWE-502
Which versions are affected by CVE-2021-41766?
2 open source packages ship an affected version, including org.apache.karaf.management:org.apache.karaf.management.server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.karaf.management:org.apache.karaf.management.server Maven | All versions | 4.3.6 |
org.apache.karaf.management:org.apache.karaf.management.server Maven | All versions | 4.3.6 |
Products include Apache Karaf.
How do I fix CVE-2021-41766?
Upgrade org.apache.karaf.management:org.apache.karaf.management.server to 4.3.6 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2021-41766 being exploited?
There is no known exploitation of CVE-2021-41766 in the wild and no public exploit code.
Other vulnerabilities in Apache Karaf
- CVE-2026-91012 Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
- CVE-2026-91048 Missing authorization in Apache Karaf
- CVE-2022-40145 Apache Karaf: JDBC JAAS LDAP injection
- CVE-2018-11788 XML External Entity Reference in Apache Karaf
- CVE-2026-92142 Apache Karaf: Authorization bypass in JMX MBean lifecycle operations
Sources
Also known as GHSA-jh5g-9m4v-9vv9.