CVE-2026-91006 (GCVE-0-2026-91006)

Vulnerability from cvelistv5 – Published: 2026-09-28 10:44 – Updated: 2026-09-28 10:44
VLAI
Title
Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
Summary
Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value containing shell metacharacters (;, |, `, $(...)) is interpreted by the shell instead of being passed to the JVM as an option, giving arbitrary OS command execution as the Karaf process user. Reachable via the shell commands instance:create, instance:start, instance:restart, instance:change-opts, and the equivalent InstanceMBean JMX operations (createInstance, startInstance, changeJavaOpts, cloneInstance). Mitigation  * Set karaf.secured.command.compulsory.roles=admin in etc/system.properties to close the fail-open gap for all unconfigured command scopes. * Restrict which principals can reach instance:* commands and InstancesMBean via etc/users.properties role assignments. * Treat javaOpts passed to instance:create/instance:start/instance:change-opts/InstancesMBean as untrusted input only from fully-trusted operators.
Severity
No CVSS data available.
CWE
  • CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
Impacted products
Vendor Product Version CPE status
Apache Software Foundation Apache Karaf Affected: 0 , < 4.4.12 (semver)
guessed Create a notification for this product.
Credits
n0mi1k <nomilksec@gmail.com>
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageName": "org.apache.karaf:org.apache.karaf.instance.core",
          "product": "Apache Karaf",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "4.4.12",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "n0mi1k \u003cnomilksec@gmail.com\u003e"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Apache Karaf\u0027s instance-management service (\u003ccode\u003eInstanceServiceImpl\u003c/code\u003e) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through\u0026nbsp;\u003ccode\u003e/bin/sh\u0026nbsp;\u003c/code\u003e(Unix) or\u0026nbsp;\u003ccode\u003ecscript\u003c/code\u003e\u0026nbsp;(Windows). The caller-supplied\u0026nbsp;\u003ccode\u003ejavaOpts\u003c/code\u003e\u0026nbsp;value is spliced into that string unquoted. A javaOpts value containing shell metacharacters (\u003ccode\u003e;\u003c/code\u003e,\u0026nbsp;\u003ccode\u003e|\u003c/code\u003e,\u0026nbsp;\u003ccode\u003e`\u003c/code\u003e,\u0026nbsp;\u003ccode\u003e$(...)\u003c/code\u003e) is interpreted by the shell instead of being passed to the JVM as an option, giving arbitrary OS command execution as the Karaf process user.\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eReachable via the shell commands\u0026nbsp;\u003ccode\u003einstance:create\u003c/code\u003e,\u0026nbsp;\u003ccode\u003einstance:start\u003c/code\u003e,\u0026nbsp;\u003ccode\u003einstance:restart\u003c/code\u003e,\u0026nbsp;\u003ccode\u003einstance:change-opts\u003c/code\u003e, and the equivalent\u0026nbsp;\u003ccode\u003eInstanceMBean\u003c/code\u003e\u0026nbsp;JMX operations (\u003ccode\u003ecreateInstance\u003c/code\u003e,\u0026nbsp;\u003ccode\u003estartInstance\u003c/code\u003e,\u0026nbsp;\u003ccode\u003echangeJavaOpts\u003c/code\u003e,\u0026nbsp;\u003ccode\u003ecloneInstance\u003c/code\u003e).\u003c/div\u003e\u003ch3\u003eMitigation\u0026nbsp;\u003c/h3\u003e\u003cdiv\u003e\u003cul\u003e\u003cli\u003eSet\u0026nbsp;\u003ccode\u003ekaraf.secured.command.compulsory.roles=admin\u003c/code\u003e\u0026nbsp;in\u0026nbsp;\u003ccode\u003eetc/system.properties\u003c/code\u003e\u0026nbsp;to close the fail-open gap for all unconfigured command scopes.\u003c/li\u003e\u003cli\u003eRestrict which principals can reach\u0026nbsp;\u003ccode\u003einstance:*\u003c/code\u003e\u0026nbsp;commands and\u0026nbsp;\u003ccode\u003eInstancesMBean\u003c/code\u003e\u0026nbsp;via\u0026nbsp;\u003ccode\u003eetc/users.properties\u003c/code\u003e\u0026nbsp;role assignments.\u003c/li\u003e\u003cli\u003eTreat\u0026nbsp;\u003ccode\u003ejavaOpts\u003c/code\u003e\u0026nbsp;passed to i\u003ccode\u003enstance:create\u003c/code\u003e/\u003ccode\u003einstance:start\u003c/code\u003e/\u003ccode\u003einstance:change-opts\u003c/code\u003e/\u003ccode\u003eInstancesMBean\u003c/code\u003e\u0026nbsp;as untrusted input only from fully-trusted operators.\u003c/li\u003e\u003c/ul\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e"
            }
          ],
          "value": "Apache Karaf\u0027s instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through\u00a0/bin/sh\u00a0(Unix) or\u00a0cscript\u00a0(Windows). The caller-supplied\u00a0javaOpts\u00a0value is spliced into that string unquoted. A javaOpts value containing shell metacharacters (;,\u00a0|,\u00a0`,\u00a0$(...)) is interpreted by the shell instead of being passed to the JVM as an option, giving arbitrary OS command execution as the Karaf process user.\n\n\nReachable via the shell commands\u00a0instance:create,\u00a0instance:start,\u00a0instance:restart,\u00a0instance:change-opts, and the equivalent\u00a0InstanceMBean\u00a0JMX operations (createInstance,\u00a0startInstance,\u00a0changeJavaOpts,\u00a0cloneInstance).\n\nMitigation\u00a0  *  Set\u00a0karaf.secured.command.compulsory.roles=admin\u00a0in\u00a0etc/system.properties\u00a0to close the fail-open gap for all unconfigured command scopes.\n  *  Restrict which principals can reach\u00a0instance:*\u00a0commands and\u00a0InstancesMBean\u00a0via\u00a0etc/users.properties\u00a0role assignments.\n  *  Treat\u00a0javaOpts\u00a0passed to instance:create/instance:start/instance:change-opts/InstancesMBean\u00a0as untrusted input only from fully-trusted operators."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-28T10:44:32.652Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/olzy0yjw82b20w59vonfjr1x7v5yzocr"
        }
      ],
      "source": {
        "advisory": "https://karaf.apache.org/security/cve-2026-91006.txt",
        "defect": [
          "https://github.com/apache/karaf/pull/2878"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)",
      "x_generator": {
        "engine": "Vulnogram 1.0.3"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2026-91006",
    "datePublished": "2026-09-28T10:44:32.652Z",
    "dateReserved": "2026-09-14T15:56:23.927Z",
    "dateUpdated": "2026-09-28T10:44:32.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "packageName": "org.apache.karaf:org.apache.karaf.instance.core",
                "product": "Apache Karaf",
                "vendor": "Apache Software Foundation",
                "versions": [
                  {
                    "lessThan": "4.4.12",
                    "status": "affected",
                    "version": "0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@apache.org"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Apache Karaf\u0027s instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through\u00a0/bin/sh\u00a0(Unix) or\u00a0cscript\u00a0(Windows). The caller-supplied\u00a0javaOpts\u00a0value is spliced into that string unquoted. A javaOpts value containing shell metacharacters (;,\u00a0|,\u00a0`,\u00a0$(...)) is interpreted by the shell instead of being passed to the JVM as an option, giving arbitrary OS command execution as the Karaf process user.\n\n\nReachable via the shell commands\u00a0instance:create,\u00a0instance:start,\u00a0instance:restart,\u00a0instance:change-opts, and the equivalent\u00a0InstanceMBean\u00a0JMX operations (createInstance,\u00a0startInstance,\u00a0changeJavaOpts,\u00a0cloneInstance).\n\nMitigation\u00a0  *  Set\u00a0karaf.secured.command.compulsory.roles=admin\u00a0in\u00a0etc/system.properties\u00a0to close the fail-open gap for all unconfigured command scopes.\n  *  Restrict which principals can reach\u00a0instance:*\u00a0commands and\u00a0InstancesMBean\u00a0via\u00a0etc/users.properties\u00a0role assignments.\n  *  Treat\u00a0javaOpts\u00a0passed to instance:create/instance:start/instance:change-opts/InstancesMBean\u00a0as untrusted input only from fully-trusted operators."
          }
        ],
        "id": "CVE-2026-91006",
        "lastModified": "2026-09-28T11:16:48.200",
        "metrics": {},
        "published": "2026-09-28T11:16:48.200",
        "references": [
          {
            "source": "security@apache.org",
            "url": "https://lists.apache.org/thread/olzy0yjw82b20w59vonfjr1x7v5yzocr"
          }
        ],
        "sourceIdentifier": "security@apache.org",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-78"
              }
            ],
            "source": "security@apache.org",
            "type": "Primary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.