This is an automated email from the ASF dual-hosted git repository.
jbonofre pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/karaf-site.git
The following commit(s) were added to refs/heads/trunk by this push:
new b5817c9 Disclose CVE-2026-91048
b5817c9 is described below
commit b5817c9a689f1d49dce4ffeea81bc3957ee86fe7
Author: JB Onofré <[email protected]>
AuthorDate: Mon Sep 28 17:48:33 2026 +0200
Disclose CVE-2026-91048
---
documentation.html | 11 +++++++++--
security/cve-2026-91048.txt | 42 ++++++++++++++++++++++++++++++++++++++++++
2 files changed, 51 insertions(+), 2 deletions(-)
diff --git a/documentation.html b/documentation.html
index 24787dc..da97a61 100644
--- a/documentation.html
+++ b/documentation.html
@@ -224,17 +224,24 @@ permalink: /documentation
<div class="k-admonition">
<div class="k-admonition-icon"><i class="fas fa-shield-halved"></i></div>
<div>
- <p>CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance
Launch (instance:* / InstancesMBean) </p>
+ <p>CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance
Launch (instance:* / InstancesMBean)</p>
<a class="btn btn-outline-primary btn-sm"
href="/security/cve-2026-91006.txt">Notes »</a>
</div>
</div>
<div class="k-admonition">
<div class="k-admonition-icon"><i class="fas fa-shield-halved"></i></div>
<div>
- <p>CVE-2026-91012: Apache Karaf: Path Traversal in Config Service Allows
Manager-to-Admin Privilege Escalation </p>
+ <p>CVE-2026-91012: Apache Karaf: Path Traversal in Config Service Allows
Manager-to-Admin Privilege Escalation</p>
<a class="btn btn-outline-primary btn-sm"
href="/security/cve-2026-91012.txt">Notes »</a>
</div>
</div>
+ <div class="k-admonition">
+ <div class="k-admonition-icon"><i class="fas fa-shield-halved"></i></div>
+ <div>
+ <p>CVE-2026-91048: Apache Karaf: Missing authorization on the jdbc:*
shell command scope allows privilege escalation to remote code execution via
jdbc:ds-create</p>
+ <a class="btn btn-outline-primary btn-sm"
href="/security/cve-2026-91048.txt">Notes »</a>
+ </div>
+ </div>
<div class="k-admonition">
<div class="k-admonition-icon"><i class="fas fa-shield-halved"></i></div>
<div>
diff --git a/security/cve-2026-91048.txt b/security/cve-2026-91048.txt
new file mode 100644
index 0000000..d25e98a
--- /dev/null
+++ b/security/cve-2026-91048.txt
@@ -0,0 +1,42 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA256
+
+CVE-2026-91048: Apache Karaf: Missing authorization on the jdbc:* shell
command scope allows privilege escalation to remote code execution via
jdbc:ds-create
+
+Severity: moderate
+
+Affected versions:
+
+- - Apache Karaf before 4.4.12
+
+Description:
+
+The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg.
Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no
matching ACL rule as allowed, so any authenticated shell session (including one
holding only the viewer role) could run every jdbc:* command. jdbc:ds-create
stores a fully attacker-controlled JDBC URL into a pax-jdbc-config factory
Configuration with no validation. pax-jdbc-config reactively turns that into a
live DataSource. Several JD [...]
+
+The same applies to jms:* shell commands.
+
+Credit:
+
+MopMonk-AI <[email protected]> (reporter)
+
+References:
+
+https://karaf.apache.org/
+https://www.cve.org/CVERecord?id=CVE-2026-91048
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCAA5FiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAmq6i+EbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEL/y7kLIKC52K5cQAJ9KdFR8N6Mia/SlxGTL
+DwoklX6pvime5N+lewF6jRbHksHncA3d+BhKYXhGqjZvQewAsiQR1hadf8yeLurT
+5X3oyNq9XZjEs3fnC7iFR0P9eBpB5isBA8Zmnv09lDyOdfmvKbYG8Bydx6QhMNBh
+9bMxz665RRCAyh27hpAFuXsNGdx5HlA3wabInYxdIuBBRvOlYpIcz+tEyDZk4LcO
+zLPd+p14Vao5eAHrASEgnFp16ZVoOdHwzj1oSXyKdGbJw8WL77VHsKoD2k95fD6O
+sCACutAHlIUBmzILt1YtCmuwTXymrrJ6sOZ38a/6QfZKzwKgiHJ1jfJNDf2SsrlI
+MyTWaYhoPXHLiTD2c7Pr+b1r8Yu9nC7H72sHMbHssABaHnG5oM8cON7SHt7NFRNc
+ozrvuk/TZIjEMk5XN6PIPJi73QQRgTmjsCIvpksmx/V7Q6b3tftwT0p5F4Epd/YH
+bZKOSLB0okT4CYMcq1dbSaMG6gv8Br/pgApEcxOwv1XzKsufKzXWpRXcwczuR29r
+8wNorm8WfziKKyct6EHYPZkbQCiUA++jm+lZ1uDtJcQSRLgSVXhGtwNtpRf0YAY0
+izJ+SwP/4rxD5QPaV13mTM3AHCuoStxS0bv1BSfkg7Z1kie3+NVXk7LMLKSgQKrb
+dVk8M2s+azHTGO+hGtpAT9aJ
+=KAg1
+-----END PGP SIGNATURE-----
