FKIE_CVE-2026-91085

Vulnerability from fkie_nvd - Published: 2026-09-29 09:17 - Updated: 2026-09-29 14:56
Severity
Summary
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactoryImpl.checkSecurity() resolves the roles required for an invocation and, when no ACL rule matches the command, fails open: ACLConfigurationParser.Specificity.NO_MATCH sets passCheck = true. The safety valve for this, karaf.secured.command.compulsory.roles, ships commented out in etc/system.properties, so an unmatched command is allowed for any authenticated user. The shipped org.apache.karaf.command.acl.config ACL (assemblies/features/standard/src/main/feature/feature.xml, mirrored into instance/.../etc/org.apache.karaf.command.acl.config.cfg) has no install entry. It restricts delete to admin, restricts edit/property-*/update on the jmx.acl.*, org.apache.karaf.command.acl.* and org.apache.karaf.service.acl.* PIDs to admin, and allows manager for everything else, but config:install was simply unmatched, and therefore allowed for any authenticated user, including one holding only the viewer role. config:install <url> <finalname> fetches url and writes it into ${karaf.etc} as finalname. It calls PathUtils.checkWithin() to block .. traversal outside karaf.etc, but that folder holds every security-relevant file Karaf ships: users.properties, keys.properties, host.key, and all org.apache.karaf.*.acl.* files, including the very ACL file that (mis)governs this command. With -o/--override, an existing file is overwritten with attacker-controlled bytes fetched from an arbitrary URL. Because felix.fileinstall.dir = ${karaf.etc} (etc/config.properties), Felix FileInstall also watches and reloads any .cfg file dropped there, closing the loop without requiring a restart. By contrast, bundle:install, feature:install and kar:install are all admin-only in their own ACLs, and config:delete is admin in this same ACL, config:install was the outlier. MitigationAdd install = admin in etc/org.apache.karaf.command.acl.config.cfg (create the file is absent), and/or set karaf.secured.command.compulsory.roles=admin in etc/system.properties (and restart) to make unmatched commands fail closed by default.
References
security@apache.orghttps://karaf.apache.org/security/cve-2026-91085.txt
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2026/09/28/10
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Karaf",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "4.4.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@apache.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Apache Karaf\u0027s shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.\u003cscope\u003e.cfg).\u00a0SecuredSessionFactoryImpl.checkSecurity()\u00a0resolves the roles required for an invocation and, when no ACL rule matches the command, fails open:\u00a0ACLConfigurationParser.Specificity.NO_MATCH\u00a0sets\u00a0passCheck = true. The safety valve for this,\u00a0karaf.secured.command.compulsory.roles, ships commented out in\u00a0etc/system.properties, so an unmatched command is allowed for any authenticated user.\n\n\nThe shipped\u00a0org.apache.karaf.command.acl.config\u00a0ACL (assemblies/features/standard/src/main/feature/feature.xml, mirrored into\u00a0instance/.../etc/org.apache.karaf.command.acl.config.cfg) has no\u00a0install\u00a0entry. It restricts\u00a0delete\u00a0to\u00a0admin, restricts\u00a0edit/property-*/update\u00a0on the\u00a0jmx.acl.*,\u00a0org.apache.karaf.command.acl.*\u00a0and\u00a0org.apache.karaf.service.acl.*\u00a0PIDs to\u00a0admin, and allows\u00a0manager\u00a0for everything else, but\u00a0config:install\u00a0was simply unmatched, and therefore allowed for any authenticated user, including one holding only the\u00a0viewer\u00a0role.\n\n\n\n\nconfig:install \u003curl\u003e \u003cfinalname\u003e\u00a0fetches\u00a0url\u00a0and writes it into\u00a0${karaf.etc}\u00a0as\u00a0finalname. It calls\u00a0PathUtils.checkWithin()\u00a0to block\u00a0..\u00a0traversal outside\u00a0karaf.etc, but that folder holds every security-relevant file Karaf ships:\u00a0users.properties,\u00a0keys.properties,\u00a0host.key, and all\u00a0org.apache.karaf.*.acl.*\u00a0files, including the very ACL file that (mis)governs this command. With\u00a0-o/--override, an existing file is overwritten with attacker-controlled bytes fetched from an arbitrary URL.\n\n\n\n\nBecause\u00a0felix.fileinstall.dir = ${karaf.etc}\u00a0(etc/config.properties), Felix FileInstall also watches and reloads any\u00a0.cfg\u00a0file dropped there, closing the loop without requiring a restart.\n\n\n\n\nBy contrast,\u00a0bundle:install,\u00a0feature:install\u00a0and\u00a0kar:install\u00a0are all\u00a0admin-only in their own ACLs, and\u00a0config:delete\u00a0is\u00a0admin\u00a0in this same ACL,\u00a0config:install\u00a0was the outlier.\n\nMitigationAdd\u00a0install = admin\u00a0in\u00a0etc/org.apache.karaf.command.acl.config.cfg\u00a0(create the file is absent), and/or set\u00a0karaf.secured.command.compulsory.roles=admin\u00a0in\u00a0etc/system.properties\u00a0(and restart) to make unmatched commands fail closed by default."
    }
  ],
  "id": "CVE-2026-91085",
  "lastModified": "2026-09-29T14:56:12.013",
  "metrics": {},
  "published": "2026-09-29T09:17:10.347",
  "references": [
    {
      "source": "security@apache.org",
      "url": "https://karaf.apache.org/security/cve-2026-91085.txt"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2026/09/28/10"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.