https://seclists.org/oss-sec/2026/q3/967: CVE-2026-91012: Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation

Q: Which users can exploit this under the shipped access controls?

Any caller with the Karaf "manager" role can reach the affected update paths through the config MBean or config:* shell commands. Administrator privileges are not required.

Q: What access does an attacker need to turn this into a meaningful impact?

The attacker needs a manager-role account and access to an affected Karaf instance. The resulting write is limited by the filesystem permissions of the Karaf process, but may target any path that process can write.

Q: Are default command and JMX ACL settings affected?

Yes. Karaf's shipped command/JMX ACL grants the manager role access to config updates through the "update = manager" rule.

Q: What upgrade version addresses the affected range?

Apache Karaf versions before 4.4.12 are affected. Upgrade to 4.4.12 or later.

Published Sep 28, 2026

Updated

Affected Software

1 affected component

Apache Karaf<4.4.12

Frequently Asked Questions

Which users can exploit this under the shipped access controls?

Any caller with the Karaf "manager" role can reach the affected update paths through the config MBean or config:* shell commands. Administrator privileges are not required.

What access does an attacker need to turn this into a meaningful impact?

The attacker needs a manager-role account and access to an affected Karaf instance. The resulting write is limited by the filesystem permissions of the Karaf process, but may target any path that process can write.

Are default command and JMX ACL settings affected?

Yes. Karaf's shipped command/JMX ACL grants the manager role access to config updates through the "update = manager" rule.

What upgrade version addresses the affected range?

Apache Karaf versions before 4.4.12 are affected. Upgrade to 4.4.12 or later.