Apache Apache Karaf
16 CVEs affecting Apache Apache Karaf. Latest disclosed: 2026-09-29. Critical: 4, High: 7.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-91048 | Critical | 9.8 | 2026-09-29 | The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no match… |
CVE-2026-91012 | Critical | 9.8 | 2026-09-29 | org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the fil… |
CVE-2022-40145 | Critical | 9.8 | 2022-12-21 | This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modul… |
CVE-2018-11788 | Critical | 9.8 | 2019-01-07 | Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features X… |
CVE-2026-92142 | High | 8.8 | 2026-09-29 | Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the r… |
CVE-2026-91006 | High | 8.8 | 2026-09-28 | Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then execute… |
CVE-2018-11786 | High | 8.8 | 2018-09-18 | In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to th… |
CVE-2021-41766 | High | 8.1 | 2022-01-26 | Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that reli… |
CVE-2018-11787 | High | 8.1 | 2018-09-18 | In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires aut… |
CVE-2026-92230 | High | 7.5 | 2026-09-17 | Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outli… |
CVE-2026-90979 | High | 7.3 | 2026-09-28 | LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn… |
CVE-2019-0191 | Medium | 6.5 | 2019-03-21 | Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the co… |
CVE-2016-8750 | Medium | 6.5 | 2018-02-19 | Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence w… |
CVE-2026-91085 | Medium | 6.3 | 2026-09-29 | Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactor… |
CVE-2022-22932 | Medium | 5.3 | 2022-01-26 | Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as… |
CVE-2026-24656 | Low | 3.7 | 2026-01-26 | Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter. The Decanter log socket collector exposes the port 4560, without authentication. If… |