Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Apache Karaf 4.4.12 Clear all filters
TI-2026-62238 CVE-2026-92142 · GHSA-5rr2-29jr-5v63

Apache Karaf: Authorization bypass in JMX MBean lifecycle operations

Priority MEDIUM 41

Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX connector (RMI registry/server, enabled by default…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00604 Published 2026-09-29 Fixed in 4.4.12 CWE-862
TI-2026-61863 CVE-2026-91048 · GHSA-pq4f-45cw-mm5m

Missing authorization in Apache Karaf

Priority MEDIUM 50

The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00544 Published 2026-09-29 Fixed in 4.4.12 CWE-862
TI-2026-61851 CVE-2026-91012 · GHSA-q6wq-m79c-29mj

Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation

Priority MEDIUM 50

org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the file it writes a configuration to from caller-supplied input wit…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00628 Published 2026-09-29 Fixed in 4.4.12 CWE-22