{"id":"CVE-2026-91085","summary":"Apache Karaf: config:install missing ACL entry allows privilege escalation to admin","details":"Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.\u003cscope\u003e.cfg). SecuredSessionFactoryImpl.checkSecurity() resolves the roles required for an invocation and, when no ACL rule matches the command, fails open: ACLConfigurationParser.Specificity.NO_MATCH sets passCheck = true. The safety valve for this, karaf.secured.command.compulsory.roles, ships commented out in etc/system.properties, so an unmatched command is allowed for any authenticated user.\n\n\nThe shipped org.apache.karaf.command.acl.config ACL (assemblies/features/standard/src/main/feature/feature.xml, mirrored into instance/.../etc/org.apache.karaf.command.acl.config.cfg) has no install entry. It restricts delete to admin, restricts edit/property-*/update on the jmx.acl.*, org.apache.karaf.command.acl.* and org.apache.karaf.service.acl.* PIDs to admin, and allows manager for everything else, but config:install was simply unmatched, and therefore allowed for any authenticated user, including one holding only the viewer role.\n\n\n\n\nconfig:install \u003curl\u003e \u003cfinalname\u003e fetches url and writes it into ${karaf.etc} as finalname. It calls PathUtils.checkWithin() to block .. traversal outside karaf.etc, but that folder holds every security-relevant file Karaf ships: users.properties, keys.properties, host.key, and all org.apache.karaf.*.acl.* files, including the very ACL file that (mis)governs this command. With -o/--override, an existing file is overwritten with attacker-controlled bytes fetched from an arbitrary URL.\n\n\n\n\nBecause felix.fileinstall.dir = ${karaf.etc} (etc/config.properties), Felix FileInstall also watches and reloads any .cfg file dropped there, closing the loop without requiring a restart.\n\n\n\n\nBy contrast, bundle:install, feature:install and kar:install are all admin-only in their own ACLs, and config:delete is admin in this same ACL, config:install was the outlier.\n\nMitigationAdd install = admin in etc/org.apache.karaf.command.acl.config.cfg (create the file is absent), and/or set karaf.secured.command.compulsory.roles=admin in etc/system.properties (and restart) to make unmatched commands fail closed by default.","modified":"2026-10-09T02:46:42.158303327Z","published":"2026-09-29T08:39:33.209Z","database_specific":{"cna_assigner":"apache","cwe_ids":["CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91085.json","unresolved_ranges":[{"extracted_events":[{"fixed":"4.4.12"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/09/28/10"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91085.json"},{"type":"ADVISORY","url":"https://karaf.apache.org/security/cve-2026-91085.txt"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91085"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/karaf","events":[{"introduced":"0"},{"fixed":"189048fff3422afaadcbbb57d95b257cb35248ad"}],"database_specific":{"cpe":"cpe:2.3:a:apache:karaf:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"4.4.12"}],"source":"CPE_RANGE"}}],"versions":["karaf-4.4.8","karaf-4.4.7","karaf-4.4.6","karaf-4.4.5","karaf-4.4.4","karaf-4.4.3","karaf-4.4.2","karaf-4.4.1","karaf-4.4.0","karaf-4.3.3","karaf-4.3.2","karaf-4.3.1","karaf-4.3.0","karaf-4.3.0.RC1","karaf-4.2.3","karaf-4.2.2","karaf-4.2.1","karaf-4.2.0","karaf-4.2.0.M2","karaf-4.2.0.M1","karaf-4.1.1","karaf-4.1.0","karaf-4.0.4","karaf-4.0.3","karaf-4.0.2","karaf-4.0.1","karaf-4.0.0.M2","karaf-4.0.0.M1","karaf-3.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91085.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}]}