https://seclists.org/oss-sec/2026/q3/962: CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)

Q: Which deployments are affected?

Apache Karaf installations using org.apache.karaf.instance.core before version 4.4.12 are affected. Exploitation targets the instance-management service used to launch or manage child Karaf instances.

Q: What access does an attacker need to exploit this?

The attacker needs access to an instance-management entry point that accepts javaOpts, such as the instance:create, instance:start, instance:restart, or instance:change-opts shell commands, or equivalent InstancesMBean JMX operations. A supplied javaOpts value containing shell metacharacters can execute commands as the Karaf process user.

Q: Are unconfigured command scopes safe by default?

No. The advisory describes a fail-open gap for unconfigured command scopes; setting karaf.secured.command.compulsory.roles=admin in etc/system.properties closes that gap for all such scopes.

Q: What can be done before upgrading?

Restrict the principals permitted to use instance:* commands and InstancesMBean through role assignments in etc/users.properties. Treat javaOpts supplied through the affected shell commands or JMX operations as untrusted input.

Published Sep 28, 2026

Updated

Affected Software

1 affected component

Apache Karaf<4.4.12

Frequently Asked Questions

Which deployments are affected?

Apache Karaf installations using org.apache.karaf.instance.core before version 4.4.12 are affected. Exploitation targets the instance-management service used to launch or manage child Karaf instances.

What access does an attacker need to exploit this?

The attacker needs access to an instance-management entry point that accepts javaOpts, such as the instance:create, instance:start, instance:restart, or instance:change-opts shell commands, or equivalent InstancesMBean JMX operations. A supplied javaOpts value containing shell metacharacters can execute commands as the Karaf process user.

Are unconfigured command scopes safe by default?

No. The advisory describes a fail-open gap for unconfigured command scopes; setting karaf.secured.command.compulsory.roles=admin in etc/system.properties closes that gap for all such scopes.

What can be done before upgrading?

Restrict the principals permitted to use instance:* commands and InstancesMBean through role assignments in etc/users.properties. Treat javaOpts supplied through the affected shell commands or JMX operations as untrusted input.