CVE-2026-91012

{"id": "CVE-2026-91012", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-91012", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-01T14:10:12.183455Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Karaf", "versions": [{"status": "affected", "version": "0", "lessThan": "4.4.12", "versionType": "semver"}], "packageName": "org.apache.karaf.config.core.impl", "defaultStatus": "unaffected"}]}], "published": "2026-09-29T09:17:09.087", "references": [{"url": "https://lists.apache.org/thread/op8trtz1qxkdwj2rjozhd9yt2yd6nhw4", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/09/28/8", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties),\nwhich backs the \"config\" MBean and the config:* shell commands, derives the file\nit writes a configuration to from caller-supplied input without checking that\nthe result stays inside\u00a0${karaf.etc}:\n\n * if the submitted property map contains a\u00a0felix.fileinstall.filename\u00a0entry, that value is turned directly into a\u00a0File\u00a0(getCfgFileFromProperty), so it can point to any absolute path the Karaf process can write to;\n * otherwise the configuration PID is concatenated verbatim into the target file name (generateConfigFilename(): new File(karaf.etc, pid + \".cfg\")), so a PID containing \"..\" segments resolves outside\u00a0${karaf.etc}.\u00a0createFactoryConfiguration()\u00a0has the same issue via the factory PID/alias.\n\n\nBoth code paths are reachable by any caller holding the \"manager\" role under Karaf's shipped command/JMX ACL (org.apache.karaf.command.acl.conf.cfg:\u00a0\"update = manager\"). Such a user can therefore write attacker-controlled content to any file the Karaf process can write, including files the same ACL otherwise reserves to \"admin\" (etc/users.properties,\u00a0etc/*.acl.*.cfg,\u00a0etc/org.apache.karaf.management.cfg, and similar), allowing a manager-role user to grant themselves the admin role or otherwise take over the container.\n\n\n\n\n\n\nConfigMBeanImpl.install()\u00a0and the\u00a0config:install\u00a0shell command already guarded the equivalent risk on their own code path with a\u00a0finalname.contains(\"..\")\u00a0string check, but that check does not stop absolute paths or symlink-based escapes, and it was never applied to\u00a0ConfigRepositoryImpl.update()\u00a0/\u00a0createFactoryConfiguration()\u00a0at all."}], "lastModified": "2026-10-07T20:16:25.743", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "532915B7-A52C-450A-A6BF-0FAE4B4144CD", "versionEndExcluding": "4.4.12"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}