https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-92142.htmlhttps://patchthecve.com/cve/CVE-2026-92142.htmlWed, 07 Oct 2026 20:07:16 +0000HIGH 8.8: Apache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked over the remote JMX connector (RMI registry/server, enabled by default on ports 1099 and 44444). The guard is implemented as a java.lang.reflect.Proxy https://patchthecve.com/cve/CVE-2026-91085.htmlhttps://patchthecve.com/cve/CVE-2026-91085.htmlWed, 07 Oct 2026 20:11:43 +0000MEDIUM 6.3: Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactoryImpl.checkSecurity() resolves the roles required for an invocation and, when no ACL rule matches the command, fails open: ACLConfigurationPahttps://patchthecve.com/cve/CVE-2026-91048.htmlhttps://patchthecve.com/cve/CVE-2026-91048.htmlWed, 07 Oct 2026 20:14:54 +0000CRITICAL 9.8: The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the viewer role) could run every jdbc:* command. jdbchttps://patchthecve.com/cve/CVE-2026-91012.htmlhttps://patchthecve.com/cve/CVE-2026-91012.htmlWed, 07 Oct 2026 20:16:25 +0000CRITICAL 9.8: org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside ${karaf.etc}: * if the submitted https://patchthecve.com/cve/CVE-2026-91006.htmlhttps://patchthecve.com/cve/CVE-2026-91006.htmlThu, 08 Oct 2026 19:19:50 +0000HIGH 8.8: Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value chttps://patchthecve.com/cve/CVE-2026-90979.htmlhttps://patchthecve.com/cve/CVE-2026-90979.htmlThu, 08 Oct 2026 19:20:23 +0000HIGH 7.3: LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the login name, the resolved user DN, and its fully qualified namespace form) into administrator-configured filter templates (userFilter