CVE-2026-91012

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-91012", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-09-14T16:27:00.736Z", "datePublished": "2026-09-29T08:34:11.409Z", "dateUpdated": "2026-10-01T14:10:47.838Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-29T08:34:11.409Z"}, "title": "Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation", "source": {"discovery": "EXTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Karaf", "packageName": "org.apache.karaf.config.core.impl", "versions": [{"status": "affected", "version": "0", "lessThan": "4.4.12", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties),\nwhich backs the \"config\" MBean and the config:* shell commands, derives the file\nit writes a configuration to from caller-supplied input without checking that\nthe result stays inside\u00a0${karaf.etc}:\n\n * if the submitted property map contains a\u00a0felix.fileinstall.filename\u00a0entry, that value is turned directly into a\u00a0File\u00a0(getCfgFileFromProperty), so it can point to any absolute path the Karaf process can write to;\n * otherwise the configuration PID is concatenated verbatim into the target file name (generateConfigFilename(): new File(karaf.etc, pid + \".cfg\")), so a PID containing \"..\" segments resolves outside\u00a0${karaf.etc}.\u00a0createFactoryConfiguration()\u00a0has the same issue via the factory PID/alias.\n\n\nBoth code paths are reachable by any caller holding the \"manager\" role under Karaf's shipped command/JMX ACL (org.apache.karaf.command.acl.conf.cfg:\u00a0\"update = manager\"). Such a user can therefore write attacker-controlled content to any file the Karaf process can write, including files the same ACL otherwise reserves to \"admin\" (etc/users.properties,\u00a0etc/*.acl.*.cfg,\u00a0etc/org.apache.karaf.management.cfg, and similar), allowing a manager-role user to grant themselves the admin role or otherwise take over the container.\n\n\n\n\n\n\nConfigMBeanImpl.install()\u00a0and the\u00a0config:install\u00a0shell command already guarded the equivalent risk on their own code path with a\u00a0finalname.contains(\"..\")\u00a0string check, but that check does not stop absolute paths or symlink-based escapes, and it was never applied to\u00a0ConfigRepositoryImpl.update()\u00a0/\u00a0createFactoryConfiguration()\u00a0at all.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<div><span>org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties)</span>,\nwhich backs the \"config\" MBean and the config:* shell commands, derives the file\nit writes a configuration to from caller-supplied input without checking that\nthe result stays inside&nbsp;<code>${karaf.etc}</code>:</div><div><ul><li>if the submitted property map contains a&nbsp;<code>felix.fileinstall.filename</code>&nbsp;entry, that value is turned directly into a&nbsp;<code>File</code>&nbsp;(<code>getCfgFileFromProperty</code>), so it can point to any absolute path the Karaf process can write to;</li><li>otherwise the configuration PID is concatenated verbatim into the target file name (<code>generateConfigFilename(): new File(karaf.etc, pid + \".cfg\")</code>), so a PID containing \"..\" segments resolves outside&nbsp;<code>${karaf.etc}</code>.&nbsp;<code>createFactoryConfiguration()</code>&nbsp;has the same issue via the factory PID/alias.</li></ul><div>Both code paths are reachable by any caller holding the \"manager\" role under Karaf's shipped command/JMX ACL (<code>org.apache.karaf.command.acl.conf.cfg:</code>&nbsp;\"<code>update = manager</code>\"). Such a user can therefore write attacker-controlled content to any file the Karaf process can write, including files the same ACL otherwise reserves to \"<code>admin</code>\" (<code>etc/users.properties</code>,&nbsp;<code>etc/*.acl.*.cfg</code>,&nbsp;<code>etc/org.apache.karaf.management.cfg</code>, and similar), allowing a manager-role user to grant themselves the admin role or otherwise take over the container.</div></div><div><br></div><div><span>ConfigMBeanImpl.install()</span>&nbsp;and the&nbsp;<code>config:install</code>&nbsp;shell command already guarded the equivalent risk on their own code path with a&nbsp;<code>finalname.contains(\"..\")</code>&nbsp;string check, but that check does not stop absolute paths or symlink-based escapes, and it was never applied to&nbsp;<code>ConfigRepositoryImpl.update()</code>&nbsp;/&nbsp;<code>createFactoryConfiguration()</code>&nbsp;at all.</div>"}]}], "references": [{"url": "https://lists.apache.org/thread/op8trtz1qxkdwj2rjozhd9yt2yd6nhw4", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "credits": [{"lang": "en", "value": "n0mi1k <nomilksec@gmail.com>", "type": "reporter"}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/28/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-29T09:15:41.656Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-22", "lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-10-01T14:10:12.183455Z", "id": "CVE-2026-91012", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T14:10:47.838Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/09/28/8"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-09-29T09:15:41.656Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-91012", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-01T14:10:12.183455Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T14:09:32.361Z"}}], "cna": {"title": "Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "n0mi1k <nomilksec@gmail.com>"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Karaf", "versions": [{"status": "affected", "version": "0", "lessThan": "4.4.12", "versionType": "semver"}], "packageName": "org.apache.karaf.config.core.impl", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread/op8trtz1qxkdwj2rjozhd9yt2yd6nhw4", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties),\nwhich backs the \"config\" MBean and the config:* shell commands, derives the file\nit writes a configuration to from caller-supplied input without checking that\nthe result stays inside\u00a0${karaf.etc}:\n\n * if the submitted property map contains a\u00a0felix.fileinstall.filename\u00a0entry, that value is turned directly into a\u00a0File\u00a0(getCfgFileFromProperty), so it can point to any absolute path the Karaf process can write to;\n * otherwise the configuration PID is concatenated verbatim into the target file name (generateConfigFilename(): new File(karaf.etc, pid + \".cfg\")), so a PID containing \"..\" segments resolves outside\u00a0${karaf.etc}.\u00a0createFactoryConfiguration()\u00a0has the same issue via the factory PID/alias.\n\n\nBoth code paths are reachable by any caller holding the \"manager\" role under Karaf's shipped command/JMX ACL (org.apache.karaf.command.acl.conf.cfg:\u00a0\"update = manager\"). Such a user can therefore write attacker-controlled content to any file the Karaf process can write, including files the same ACL otherwise reserves to \"admin\" (etc/users.properties,\u00a0etc/*.acl.*.cfg,\u00a0etc/org.apache.karaf.management.cfg, and similar), allowing a manager-role user to grant themselves the admin role or otherwise take over the container.\n\n\n\n\n\n\nConfigMBeanImpl.install()\u00a0and the\u00a0config:install\u00a0shell command already guarded the equivalent risk on their own code path with a\u00a0finalname.contains(\"..\")\u00a0string check, but that check does not stop absolute paths or symlink-based escapes, and it was never applied to\u00a0ConfigRepositoryImpl.update()\u00a0/\u00a0createFactoryConfiguration()\u00a0at all.", "supportingMedia": [{"type": "text/html", "value": "<div><span>org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties)</span>,\nwhich backs the \"config\" MBean and the config:* shell commands, derives the file\nit writes a configuration to from caller-supplied input without checking that\nthe result stays inside&nbsp;<code>${karaf.etc}</code>:</div><div><ul><li>if the submitted property map contains a&nbsp;<code>felix.fileinstall.filename</code>&nbsp;entry, that value is turned directly into a&nbsp;<code>File</code>&nbsp;(<code>getCfgFileFromProperty</code>), so it can point to any absolute path the Karaf process can write to;</li><li>otherwise the configuration PID is concatenated verbatim into the target file name (<code>generateConfigFilename(): new File(karaf.etc, pid + \".cfg\")</code>), so a PID containing \"..\" segments resolves outside&nbsp;<code>${karaf.etc}</code>.&nbsp;<code>createFactoryConfiguration()</code>&nbsp;has the same issue via the factory PID/alias.</li></ul><div>Both code paths are reachable by any caller holding the \"manager\" role under Karaf's shipped command/JMX ACL (<code>org.apache.karaf.command.acl.conf.cfg:</code>&nbsp;\"<code>update = manager</code>\"). Such a user can therefore write attacker-controlled content to any file the Karaf process can write, including files the same ACL otherwise reserves to \"<code>admin</code>\" (<code>etc/users.properties</code>,&nbsp;<code>etc/*.acl.*.cfg</code>,&nbsp;<code>etc/org.apache.karaf.management.cfg</code>, and similar), allowing a manager-role user to grant themselves the admin role or otherwise take over the container.</div></div><div><br></div><div><span>ConfigMBeanImpl.install()</span>&nbsp;and the&nbsp;<code>config:install</code>&nbsp;shell command already guarded the equivalent risk on their own code path with a&nbsp;<code>finalname.contains(\"..\")</code>&nbsp;string check, but that check does not stop absolute paths or symlink-based escapes, and it was never applied to&nbsp;<code>ConfigRepositoryImpl.update()</code>&nbsp;/&nbsp;<code>createFactoryConfiguration()</code>&nbsp;at all.</div>", "base64": false}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-09-29T08:34:11.409Z"}}}, "cveMetadata": {"cveId": "CVE-2026-91012", "state": "PUBLISHED", "dateUpdated": "2026-10-01T14:10:47.838Z", "dateReserved": "2026-09-14T16:27:00.736Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-09-29T08:34:11.409Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "org.apache.karaf.config.core.impl", "product": "Apache Karaf", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.4.12", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:*", "matchCriteriaId": "532915B7-A52C-450A-A6BF-0FAE4B4144CD", "versionEndExcluding": "4.4.12", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties),\nwhich backs the \"config\" MBean and the config:* shell commands, derives the file\nit writes a configuration to from caller-supplied input without checking that\nthe result stays inside\u00a0${karaf.etc}:\n\n * if the submitted property map contains a\u00a0felix.fileinstall.filename\u00a0entry, that value is turned directly into a\u00a0File\u00a0(getCfgFileFromProperty), so it can point to any absolute path the Karaf process can write to;\n * otherwise the configuration PID is concatenated verbatim into the target file name (generateConfigFilename(): new File(karaf.etc, pid + \".cfg\")), so a PID containing \"..\" segments resolves outside\u00a0${karaf.etc}.\u00a0createFactoryConfiguration()\u00a0has the same issue via the factory PID/alias.\n\n\nBoth code paths are reachable by any caller holding the \"manager\" role under Karaf's shipped command/JMX ACL (org.apache.karaf.command.acl.conf.cfg:\u00a0\"update = manager\"). Such a user can therefore write attacker-controlled content to any file the Karaf process can write, including files the same ACL otherwise reserves to \"admin\" (etc/users.properties,\u00a0etc/*.acl.*.cfg,\u00a0etc/org.apache.karaf.management.cfg, and similar), allowing a manager-role user to grant themselves the admin role or otherwise take over the container.\n\n\n\n\n\n\nConfigMBeanImpl.install()\u00a0and the\u00a0config:install\u00a0shell command already guarded the equivalent risk on their own code path with a\u00a0finalname.contains(\"..\")\u00a0string check, but that check does not stop absolute paths or symlink-based escapes, and it was never applied to\u00a0ConfigRepositoryImpl.update()\u00a0/\u00a0createFactoryConfiguration()\u00a0at all."}], "id": "CVE-2026-91012", "lastModified": "2026-10-07T20:16:25.743", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-91012", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-01T14:10:12.183455Z", "version": "2.0.3"}}]}, "published": "2026-09-29T09:17:09.087", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/op8trtz1qxkdwj2rjozhd9yt2yd6nhw4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/09/28/8"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.karaf.config/org.apache.karaf.config.core: Apache Karaf: Privilege escalation via path traversal in configuration service", "id": "2543009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2543009"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in Apache Karaf. This vulnerability allows privilege escalation when the configuration service fails to properly restrict file paths to the designated configuration directory. An authenticated user with manager-level permissions can supply directory traversal sequences or absolute file paths to write attacker-controlled content to arbitrary files. Successful exploitation enables the attacker to grant themselves administrative privileges and achieve full container takeover."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-91012", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "org.apache.karaf.config.core", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-09-29T08:34:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-91012\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-91012\nhttps://lists.apache.org/thread/op8trtz1qxkdwj2rjozhd9yt2yd6nhw4"], "statement": "This vulnerability is rated as Important because an authenticated user with low-level managerial privileges can breach role boundaries to gain full administrative control over the container environment. In Red Hat JBoss Fuse deployments, the embedded Apache Karaf configuration service fails to enforce proper boundary checks when writing configuration files. Consequently, an operator possessing standard manager rights can traverse target directories or supply absolute paths to overwrite security-sensitive files, resulting in complete privilege escalation to administrator.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.4.12)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Karaf", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "karaf", "vendor": "apache"}], "created": "2026-09-29T15:45:18.446204+00:00", "updated": "2026-10-01T17:00:15.890263+00:00", "vendors": ["apache", "apache$PRODUCT$karaf"]}