Author: jbonofre
Date: Mon Sep 28 15:51:59 2026
New Revision: 1938618
Log:
[scm-publish] Updating main website contents
Added:
karaf/site/production/security/cve-2026-91048.txt
Modified:
karaf/site/production/documentation.html
karaf/site/production/feed.xml
Modified: karaf/site/production/documentation.html
==============================================================================
--- karaf/site/production/documentation.html Mon Sep 28 15:30:54 2026
(r1938617)
+++ karaf/site/production/documentation.html Mon Sep 28 15:51:59 2026
(r1938618)
@@ -349,18 +349,25 @@
<div class="k-admonition">
<div class="k-admonition-icon"><i class="fas fa-shield-halved"></i></div>
<div>
- <p>CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance
Launch (instance:* / InstancesMBean) </p>
+ <p>CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance
Launch (instance:* / InstancesMBean)</p>
<a class="btn btn-outline-primary btn-sm"
href="/security/cve-2026-91006.txt">Notes »</a>
</div>
</div>
<div class="k-admonition">
<div class="k-admonition-icon"><i class="fas fa-shield-halved"></i></div>
<div>
- <p>CVE-2026-91012: Apache Karaf: Path Traversal in Config Service Allows
Manager-to-Admin Privilege Escalation </p>
+ <p>CVE-2026-91012: Apache Karaf: Path Traversal in Config Service Allows
Manager-to-Admin Privilege Escalation</p>
<a class="btn btn-outline-primary btn-sm"
href="/security/cve-2026-91012.txt">Notes »</a>
</div>
</div>
<div class="k-admonition">
+ <div class="k-admonition-icon"><i class="fas fa-shield-halved"></i></div>
+ <div>
+ <p>CVE-2026-91048: Apache Karaf: Missing authorization on the jdbc:*
shell command scope allows privilege escalation to remote code execution via
jdbc:ds-create</p>
+ <a class="btn btn-outline-primary btn-sm"
href="/security/cve-2026-91048.txt">Notes »</a>
+ </div>
+ </div>
+ <div class="k-admonition">
<div class="k-admonition-icon"><i class="fas fa-shield-halved"></i></div>
<div>
<p>CVE-2026-92230: Apache Karaf: Improper release of ClassLoader
references via static ThreadLocal caching</p>
Modified: karaf/site/production/feed.xml
==============================================================================
--- karaf/site/production/feed.xml Mon Sep 28 15:30:54 2026
(r1938617)
+++ karaf/site/production/feed.xml Mon Sep 28 15:51:59 2026
(r1938618)
@@ -1 +1 @@
-<?xml version="1.0" encoding="utf-8"?><feed
xmlns="http://www.w3.org/2005/Atom"; ><generator uri="https://jekyllrb.com/";
version="4.4.1">Jekyll</generator><link
href="https://karaf.apache.org/feed.xml"; rel="self" type="application/atom+xml"
/><link href="https://karaf.apache.org/"; rel="alternate" type="text/html"
/><updated>2026-09-28T10:29:34-05:00</updated><id>https://karaf.apache.org/feed.xml</id><title
type="html">Apache Karaf - The modulith runtime</title><subtitle>Karaf
provides modulith runtime for the enterprise, running on premise or on cloud.
Focus on your business code and applications, Apache Karaf deals with the
rest.</subtitle></feed>
\ No newline at end of file
+<?xml version="1.0" encoding="utf-8"?><feed
xmlns="http://www.w3.org/2005/Atom"; ><generator uri="https://jekyllrb.com/";
version="4.4.1">Jekyll</generator><link
href="https://karaf.apache.org/feed.xml"; rel="self" type="application/atom+xml"
/><link href="https://karaf.apache.org/"; rel="alternate" type="text/html"
/><updated>2026-09-28T10:51:17-05:00</updated><id>https://karaf.apache.org/feed.xml</id><title
type="html">Apache Karaf - The modulith runtime</title><subtitle>Karaf
provides modulith runtime for the enterprise, running on premise or on cloud.
Focus on your business code and applications, Apache Karaf deals with the
rest.</subtitle></feed>
\ No newline at end of file
Added: karaf/site/production/security/cve-2026-91048.txt
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ karaf/site/production/security/cve-2026-91048.txt Mon Sep 28 15:51:59
2026 (r1938618)
@@ -0,0 +1,42 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA256
+
+CVE-2026-91048: Apache Karaf: Missing authorization on the jdbc:* shell
command scope allows privilege escalation to remote code execution via
jdbc:ds-create
+
+Severity: moderate
+
+Affected versions:
+
+- - Apache Karaf before 4.4.12
+
+Description:
+
+The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg.
Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no
matching ACL rule as allowed, so any authenticated shell session (including one
holding only the viewer role) could run every jdbc:* command. jdbc:ds-create
stores a fully attacker-controlled JDBC URL into a pax-jdbc-config factory
Configuration with no validation. pax-jdbc-config reactively turns that into a
live DataSource. Several JDBC drivers run code or SQL at connection time based
on URL parameters (e.g. H2 INIT=RUNSCRIPT), so a viewer-level shell user could
reach arbitrary code execution, bypassing the admin-role gate that already
protects shell:exec. This is a privilege-escalation-to-RCE chain, not merely an
"admin misconfiguration".
+
+The same applies to jms:* shell commands.
+
+Credit:
+
+MopMonk-AI <[email protected]> (reporter)
+
+References:
+
+https://karaf.apache.org/
+https://www.cve.org/CVERecord?id=CVE-2026-91048
+-----BEGIN PGP SIGNATURE-----
+
+iQJPBAEBCAA5FiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAmq6i+EbFIAAAAAABAAO
+bWFudTIsMi41KzEuMTIsMCwzAAoJEL/y7kLIKC52K5cQAJ9KdFR8N6Mia/SlxGTL
+DwoklX6pvime5N+lewF6jRbHksHncA3d+BhKYXhGqjZvQewAsiQR1hadf8yeLurT
+5X3oyNq9XZjEs3fnC7iFR0P9eBpB5isBA8Zmnv09lDyOdfmvKbYG8Bydx6QhMNBh
+9bMxz665RRCAyh27hpAFuXsNGdx5HlA3wabInYxdIuBBRvOlYpIcz+tEyDZk4LcO
+zLPd+p14Vao5eAHrASEgnFp16ZVoOdHwzj1oSXyKdGbJw8WL77VHsKoD2k95fD6O
+sCACutAHlIUBmzILt1YtCmuwTXymrrJ6sOZ38a/6QfZKzwKgiHJ1jfJNDf2SsrlI
+MyTWaYhoPXHLiTD2c7Pr+b1r8Yu9nC7H72sHMbHssABaHnG5oM8cON7SHt7NFRNc
+ozrvuk/TZIjEMk5XN6PIPJi73QQRgTmjsCIvpksmx/V7Q6b3tftwT0p5F4Epd/YH
+bZKOSLB0okT4CYMcq1dbSaMG6gv8Br/pgApEcxOwv1XzKsufKzXWpRXcwczuR29r
+8wNorm8WfziKKyct6EHYPZkbQCiUA++jm+lZ1uDtJcQSRLgSVXhGtwNtpRf0YAY0
+izJ+SwP/4rxD5QPaV13mTM3AHCuoStxS0bv1BSfkg7Z1kie3+NVXk7LMLKSgQKrb
+dVk8M2s+azHTGO+hGtpAT9aJ
+=KAg1
+-----END PGP SIGNATURE-----
