https://seclists.org/oss-sec/2026/q3/968: CVE-2026-91048: Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to mote code execution via jdbc:ds-cate

Q: Which users can exploit this issue?

Any authenticated Karaf shell user may be able to exploit it, including a user assigned only the viewer role. The issue bypasses the existing admin-role restriction on shell:exec.

Q: What access and attacker-controlled input are required?

The attacker needs an authenticated shell session and the ability to invoke jdbc:* commands, particularly jdbc:ds-create. They can supply a fully attacker-controlled JDBC URL, which is stored and then processed into a live DataSource.

Q: Are standard affected installations exposed without an administrator changing command ACLs?

Yes. Affected Karaf releases shipped without an org.apache.karaf.command.acl.jdbc.cfg file, and the command guard allows commands when no matching ACL rule exists.

Q: How can I determine whether an installation is affected?

Apache Karaf versions before 4.4.12 are affected. Exposure exists where authenticated shell users can access the jdbc command scope; the same issue also applies to jms:* shell commands.

Published Sep 28, 2026

Updated

Affected Software

1 affected component

Apache Karaf<4.4.12

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated Karaf shell user may be able to exploit it, including a user assigned only the viewer role. The issue bypasses the existing admin-role restriction on shell:exec.

What access and attacker-controlled input are required?

The attacker needs an authenticated shell session and the ability to invoke jdbc:* commands, particularly jdbc:ds-create. They can supply a fully attacker-controlled JDBC URL, which is stored and then processed into a live DataSource.

Are standard affected installations exposed without an administrator changing command ACLs?

Yes. Affected Karaf releases shipped without an org.apache.karaf.command.acl.jdbc.cfg file, and the command guard allows commands when no matching ACL rule exists.

How can I determine whether an installation is affected?

Apache Karaf versions before 4.4.12 are affected. Exposure exists where authenticated shell users can access the jdbc command scope; the same issue also applies to jms:* shell commands.