Apache Karaf
- Software type
- Application server
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/11/2026, Apache Karaf recorded 7 security vulnerabilities in the last 90 days, of which 6 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Apache Karaf and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-92142Apache Karaf: Authorization bypass in JMX MBean lifecycle operationsCVE-2026-91085Apache Karaf: config:install missing ACL entry allows privilege escalation to adminCVE-2026-91048Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-createCVE-2026-91012Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege EscalationCVE-2026-91006Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-92142Apache Karaf: Authorization bypass in JMX MBean lifecycle operations | Exploitation statusNot exploited | FixYes |
| SeverityHigh |
CVE-2026-91085Apache Karaf: config:install missing ACL entry allows privilege escalation to admin | Exploitation statusNot exploited | FixYes | Published09/29/2026 | SeverityMedium |
|---|
CVE-2026-91048Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create | Exploitation statusNot exploited | FixYes | Published09/29/2026 | SeverityCritical |
|---|
CVE-2026-91012Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation | Exploitation statusNot exploited | FixYes | Published09/29/2026 | SeverityCritical |
|---|
CVE-2026-91006Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityHigh |
|---|
CVE-2026-90979Apache Karaf: LDAP filter injection in JAAS LDAP login modules | Exploitation statusNot exploited | FixYes | Published09/28/2026 | SeverityHigh |
|---|
CVE-2026-92230Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityHigh |
|---|
CVE-2026-24656Apache Karaf: Decanter log-socket collector has deserialization vulnerability | Exploitation statusNot exploited | FixYes | Published01/26/2026 | SeverityLow |
|---|
CVE-2022-40145Apache Karaf: JDBC JAAS LDAP injection | Exploitation statusNot exploited | FixYes | Published12/21/2022 | SeverityCritical |
|---|
CVE-2022-22932Path traversal flaws | Exploitation statusNot confirmed | FixYes | Published01/26/2022 | SeverityUnknown |
|---|
15 Results | Page 1 of 2