CVE-2026-90979: LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substit

Q: How do I fix CVE-2026-90979?

karaf: upgrade to 4.4.12. Exact commands for each OS are on this page.

Q: Is CVE-2026-90979 being exploited?

CVE-2026-90979 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2026-90979 affect?

CVE-2026-90979 affects karaf. Severity is high (CVSS 7.3). LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the login name, the resolved user DN, and its fully qualified namespace form

Q: How urgent is CVE-2026-90979?

Priority 45/100. High severity; Remotely exploitable, no login, no user action; On your watchlist

This month

HIGH 7.3REMOTEWATCHLISTUPGRADE

CVE-2026-90979 is a high-severity flaw (CVSS 7.3) affecting karaf. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the login name, the resolved user DN, and its fully qualified namespace form) into administrator-configured filter templates (userFilter, roleFilter). Before the fix, the only sanitization applied to the substituted value was double backslashed: filter = filter.replaceAll(Pattern.quot

Why this priority

High severity
Remotely exploitable, no login, no user action
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	7.3 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.4% (top 62%)
CISA exploited list	No
Weakness	CWE-90
Published	2026-09-28
Last modified	2026-10-08

Publisher (CNA): Apache Software Foundation · Vendor: apache

Last updated 2026-10-08 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-09-28 10:16 UTCPublished CVE record published
2026-10-08 19:20 UTCUpdated Record last modified

apache karaf UPGRADE

Affected: < 4.4.12

Fixed in: 4.4.12

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy karaf || rpm -q karaf || karaf --version

2. UPGRADE to 4.4.12 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade karaf

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade karaf

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-90979?

karaf: upgrade to 4.4.12. Exact commands for each OS are on this page.

Is CVE-2026-90979 being exploited?

CVE-2026-90979 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-90979 affect?

CVE-2026-90979 affects karaf. Severity is high (CVSS 7.3). LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the login name, the resolved user DN, and its fully qualified namespace form

How urgent is CVE-2026-90979?

Priority 45/100. High severity; Remotely exploitable, no login, no user action; On your watchlist

Related CVEs

CVE-2026-91006 HIGH 8.8 UPGRADE Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a chil
CVE-2026-91012 CRITICAL 9.8 UPGRADE org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean
CVE-2026-91048 CRITICAL 9.8 UPGRADE The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg
CVE-2026-91085 MEDIUM 6.3 UPGRADE Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.kar
CVE-2026-92142 HIGH 8.8 UPGRADE Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access cont

References

← Back to latest CVEs