Vulnerabilities

TI-2026-61846 CVE-2026-91006 · GHSA-2wpj-35wr-vch7

Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)

MEDIUM 42

Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01135 Published 2026-09-28 Fixed in 4.4.12 CWE-78

TI-2026-61828 CVE-2026-90979 · GHSA-932c-qw9f-cpcq

Apache Karaf: LDAP filter injection in JAAS LDAP login modules

LOW 38

LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the login name, the resolved user DN, and its fully qual…

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00441 Published 2026-09-28 Partial fix · 4.4.12 CWE-90

Vulnerabilities

Filters

Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)

Apache Karaf: LDAP filter injection in JAAS LDAP login modules