Apache Software Foundation Karaf vulnerabilities

• apache karaf Apache Karaf: Authorization bypass in JMX MBean lifecycle operations CVE-2026-92142 8.8 HighSeptember 29, 2026
• apache karaf Apache Karaf: config:install missing ACL entry allows privilege escalation to admin CVE-2026-91085 6.3 MediumSeptember 29, 2026
• apache karaf Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create CVE-2026-91048 9.8 CriticalSeptember 29, 2026
• apache karaf Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation CVE-2026-91012 9.8 CriticalSeptember 29, 2026
• apache karaf Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) CVE-2026-91006 8.8 HighSeptember 28, 2026
• apache karaf Apache Karaf: LDAP filter injection in JAAS LDAP login modules CVE-2026-90979 7.3 HighSeptember 28, 2026
• apache software foundation karaf Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching CVE-2026-92230 7.5 HighSeptember 17, 2026
• apache karaf decanter, apache software foundation karaf +1 more Apache Karaf: Decanter log-socket collector has deserialization vulnerability CVE-2026-24656 Fix available 3.7 LowJanuary 26, 2026
• apache karaf cave Apache Karaf Cave: Cave SSRF and arbitrary file access CVE-2024-34365 9.1 CriticalMay 9, 2024
• apache karaf Apache Karaf: JDBC JAAS LDAP injection CVE-2022-40145 Fix available 9.8 CriticalDecember 21, 2022
• apache karaf Path traversal flaws CVE-2022-22932 Public exploitFix available 5.3 MediumJanuary 26, 2022
• apache karaf Insecure Java Deserialization in Apache Karaf CVE-2021-41766 Fix available 8.1 HighJanuary 26, 2022
• apache karaf Server-Side Request Forgery in Karaf CVE-2020-11980 Fix available 6.3 MediumJune 12, 2020
• apache karaf Moderate severity vulnerability that affects org.apache.karaf:apache-karaf and org.apache.karaf:karaf CVE-2019-0191 Fix available 6.5 MediumMarch 20, 2019
• apache karaf XML External Entity Reference in Apache Karaf CVE-2018-11788 Public exploitFix available 9.8 CriticalJanuary 7, 2019
• apache karaf Improper Authentication in Apache Karaf CVE-2018-11787 Fix available 8.1 HighSeptember 18, 2018
• apache karaf Improper Privilege Management in Apache Karaf CVE-2018-11786 Fix available 8.8 HighSeptember 18, 2018
• apache karaf, redhat jboss a-mq, jboss fuse +2 more It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x,... CVE-2016-8648 7.2 HighAugust 1, 2018
• apache karaf Moderate severity vulnerability that affects org.apache.karaf:apache-karaf CVE-2016-8750 Fix available 6.5 MediumFebruary 19, 2018