Karaf (Apache) - vulnerabilities (CVEs)
18 CVEs, 6 in the last 30 days, 111 known versions, newest CVE from 2026-09-29. Vendor: Apache.
CVEs of Karaf
- CVE-2026-92142 - CVSS 8.8 (high), 2026-09-29: Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the…
- CVE-2026-91085 - CVSS 6.3 (medium), 2026-09-29: Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files…
- CVE-2026-91048 - CVSS 9.8 (critical), 2026-09-29: The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no…
- CVE-2026-91012 - CVSS 9.8 (critical), 2026-09-29: org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the…
- CVE-2026-91006 - CVSS 8.8 (high), 2026-09-28: Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then…
- CVE-2026-90979 - CVSS 7.3 (high), 2026-09-28: LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn…
- CVE-2022-40145 - CVSS 9.8 (critical), 2022-12-21: This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function…
- CVE-2022-22932 - CVSS 5.3 (medium), 2022-01-26: Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low…
- CVE-2021-41766 - CVSS 8.1 (high), 2022-01-26: Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that…
- CVE-2020-28052 - CVSS 8.1 (high), 2020-12-18: An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when…
- CVE-2020-11980 - CVSS 6.3 (medium), 2020-06-12: In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an…
- CVE-2019-0226 - CVSS 4.9 (medium), 2019-05-09: Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite existing file. The…
- CVE-2019-0191 - CVSS 6.5 (medium), 2019-03-21: Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the…
- CVE-2018-11788 - CVSS 9.8 (critical), 2019-01-07: Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features…
- CVE-2018-11787 - CVSS 8.1 (high), 2018-09-18: In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires…
- CVE-2018-11786 - CVSS 8.8 (high), 2018-09-18: In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to…
- CVE-2016-8750 - CVSS 6.5 (medium), 2018-02-19: Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence…
- CVE-2014-0219 - CVSS 5.5 (medium), 2017-11-15: Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdown) by sending a…
