Command Execution Vulnerability in Apache Karaf by Vendor Apache

CVE-2026-91006

What is CVE-2026-91006?

The vulnerability in Apache Karaf's instance-management service allows for arbitrary OS command execution. This occurs when the command line for launching a child JVM is constructed using untrusted input from the caller-supplied javaOpts value. Due to ineffective input handling, shell metacharacters can be interpreted by the operating system, enabling unauthorized commands to be executed with the privileges of the Karaf process user. Users can mitigate this risk by enforcing role restrictions and treating all input as untrusted unless from a fully-trusted operator.

References