The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the viewer role) could run every jdbc:* command. jdbc:ds-create stores a fully attacker-controlled JDBC URL into a pax-jdbc-config factory Configuration with no validation. pax-jdbc-config reactively turns that into a live DataSource. Several JDBC drivers run code or SQL at connection time based on URL parameters (e.g. H2 INIT=RUNSCRIPT), so a viewer-level shell user could reach arbitrary code execution, bypassing the admin-role gate that already protects shell:exec. This is a privilege-escalation-to-RCE chain, not merely an "admin misconfiguration".
The same applies to jms:* shell commands.
References
| Link | Resource |
|---|---|
| https://lists.apache.org/thread/ph3867mxh2tft75w0o1hpn10f5mbmw32 | Mailing List Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/09/28/9 | Mailing List Third Party Advisory |
Configurations
History
07 Oct 2026, 20:14
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache
Apache karaf |
|
| CPE | cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:* | |
| References | () https://lists.apache.org/thread/ph3867mxh2tft75w0o1hpn10f5mbmw32 - Mailing List, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/09/28/9 - Mailing List, Third Party Advisory |
01 Oct 2026, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
29 Sep 2026, 10:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
29 Sep 2026, 09:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-09-29 09:17
Updated : 2026-10-07 20:14
NVD link : CVE-2026-91048
Mitre link : CVE-2026-91048
CVE.ORG link : CVE-2026-91048
JSON object : View
Products Affected
apache
- karaf
CWE
CWE-862
Missing Authorization