PatchTheCVEkaraf vulnerabilities and fixes
Recent CVEs affecting karaf, with upgrade or downgrade steps. 6 tracked.
karaf has 6 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-09-29. Highest priority: CVE-2026-91012 (score 60/100).
- CVE-2026-90979 HIGH 7.3 UPGRADE LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substit
- CVE-2026-91006 HIGH 8.8 UPGRADE Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a chil
- CVE-2026-91012 CRITICAL 9.8 UPGRADE org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean
- CVE-2026-91048 CRITICAL 9.8 UPGRADE The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg
- CVE-2026-91085 MEDIUM 6.3 UPGRADE Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.kar
- CVE-2026-92142 HIGH 8.8 UPGRADE Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access cont
FAQ
How do I fix karaf vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is karaf being exploited right now?
None of the tracked karaf CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which karaf CVE should I patch first?
CVE-2026-91012 currently ranks highest (60/100): org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean.