CVE-2026-91048 Missing authorization in Apache Karaf
Missing ACLs on Karaf JDBC commands allow low-privilege users to execute arbitrary code via malicious JDBC URLs, bypassing admin restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-91048?
CVE-2026-91048 is a critical missing authorization vulnerability in Apache Karaf, published on 29 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the viewer role) could run every jdbc:* command. jdbc:ds-create stores a fully attacker-controlled JDBC URL into a pax-jdbc-config factory Configuration with no validation. pax-jdbc-config reactively turns that into a live DataSource. Several JDBC drivers run code or SQL at connection time based on URL parameters (e.g. H2 INIT=RUNSCRIPT), so a viewer-level shell user could reach arbitrary code execution, bypassing the admin-role gate that already protects shell:exec. This is a privilege-escalation-to-RCE chain, not merely an "admin misconfiguration".
The same applies to jms:* shell commands.
Weakness: CWE-862
Which versions are affected by CVE-2026-91048?
It affects 1 product.
Products include Apache Karaf.
How do I fix CVE-2026-91048?
No fix has been published for CVE-2026-91048 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-91048 being exploited?
There is no known exploitation of CVE-2026-91048 in the wild and no public exploit code.
Other vulnerabilities in Apache Karaf
- CVE-2026-91012 Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
- CVE-2022-40145 Apache Karaf: JDBC JAAS LDAP injection
- CVE-2018-11788 XML External Entity Reference in Apache Karaf
- CVE-2026-92142 Apache Karaf: Authorization bypass in JMX MBean lifecycle operations
- CVE-2026-91006 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
Sources
Also known as GHSA-pq4f-45cw-mm5m.