CVE-2026-91048
Received Received - Intake

JDBC Command Injection in Apache Karaf Shell

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: Apache Software Foundation

Description
The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the viewer role) could run every jdbc:* command. jdbc:ds-create stores a fully attacker-controlled JDBC URL into a pax-jdbc-config factory Configuration with no validation. pax-jdbc-config reactively turns that into a live DataSource. Several JDBC drivers run code or SQL at connection time based on URL parameters (e.g. H2 INIT=RUNSCRIPT), so a viewer-level shell user could reach arbitrary code execution, bypassing the admin-role gate that already protects shell:exec. This is a privilege-escalation-to-RCE chain, not merely an "admin misconfiguration". The same applies to jms:* shell commands.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-91048
EUVD
EUVD-2026-88661

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
apache karaf *
apache pax_jdbc_config *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a privilege escalation chain in Apache Karaf where authenticated users with limited roles (like 'viewer') can execute arbitrary code. The issue stems from missing access control lists (ACL) for jdbc and jms shell commands, allowing unauthorized command execution. Attackers can create malicious JDBC URLs that trigger code execution when processed by pax-jdbc-config.

Detection Guidance

Check Karaf shell sessions for unauthorized jdbc:* or jms:* command usage. Review pax-jdbc-config Configuration objects for unexpected JDBC URLs. Inspect DataSource creation logs for suspicious INIT or RUNSCRIPT parameters in JDBC URLs.

Impact Analysis

If exploited, this vulnerability allows attackers with minimal access to escalate privileges and execute arbitrary code on the system. This could lead to full system compromise, data theft, or further network infiltration. Systems using Apache Karaf with jdbc or jms commands are at risk.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data or systems. GDPR requires protecting personal data, while HIPAA mandates safeguarding health information. Exploitation could lead to breaches, resulting in legal penalties and reputational damage.

Mitigation Strategies

Apply vendor patches for Karaf and pax-jdbc-config. Restrict shell access to only trusted users. Review and remove any existing jdbc:* or jms:* ACL misconfigurations. Monitor for unauthorized DataSource creation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91048. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart