CVE-2026-91006 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
Attackers with access to instance management commands can execute arbitrary OS commands via unquoted javaOpts in Apache Karaf.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-91006?
CVE-2026-91006 is a high-severity command injection vulnerability in Apache Karaf, published on 28 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value containing shell metacharacters (;, |, `, $(...)) is interpreted by the shell instead of being passed to the JVM as an option, giving arbitrary OS command execution as the Karaf process user.
Reachable via the shell commands instance:create, instance:start, instance:restart, instance:change-opts, and the equivalent InstanceMBean JMX operations (createInstance, startInstance, changeJavaOpts, cloneInstance).
Mitigation * Set karaf.secured.command.compulsory.roles=admin in etc/system.properties to close the fail-open gap for all unconfigured command scopes. * Restrict which principals can reach instance:* commands and InstancesMBean via etc/users.properties role assignments. * Treat javaOpts passed to instance:create/instance:start/instance:change-opts/InstancesMBean as untrusted input only from fully-trusted operators.
Weakness: CWE-78
Which versions are affected by CVE-2026-91006?
It affects 1 product.
Products include Apache Karaf.
How do I fix CVE-2026-91006?
No fix has been published for CVE-2026-91006 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-91006 being exploited?
There is no known exploitation of CVE-2026-91006 in the wild and no public exploit code.
Other vulnerabilities in Apache Karaf
- CVE-2026-91012 Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
- CVE-2026-91048 Missing authorization in Apache Karaf
- CVE-2022-40145 Apache Karaf: JDBC JAAS LDAP injection
- CVE-2018-11788 XML External Entity Reference in Apache Karaf
- CVE-2026-92142 Apache Karaf: Authorization bypass in JMX MBean lifecycle operations
Sources
Also known as GHSA-2wpj-35wr-vch7.