CVE-2026-91006: Apache Karaf Instance Management RCE Vulnerability

CVE-2026-91006 Overview

CVE-2026-91006 is an OS command injection vulnerability [CWE-78] in Apache Karaf's instance-management service. The InstanceServiceImpl component builds the command line for launching a child Karaf JVM using string concatenation. It then executes the result through /bin/sh on Unix or cscript on Windows. The caller-supplied javaOpts value is spliced into that string unquoted, allowing shell metacharacters to break out of the intended argument context. An authenticated attacker who can reach instance:* shell commands or InstanceMBean JMX operations can execute arbitrary operating system commands as the Karaf process user.

Critical Impact
Authenticated attackers can achieve arbitrary OS command execution as the Karaf process user by injecting shell metacharacters into javaOpts.

Affected Products

Apache Karaf (instance-management service / InstanceServiceImpl)
InstanceMBean JMX interface exposing createInstance, startInstance, changeJavaOpts, and cloneInstance
Karaf shell commands instance:create, instance:start, instance:restart, and instance:change-opts

Discovery Timeline

2026-09-28 - CVE CVE-2026-91006 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-91006

Vulnerability Analysis

Apache Karaf provides an instance-management subsystem that spawns child JVMs to run isolated Karaf containers. The service constructs the launch command as a single shell string and hands it to /bin/sh -c on Unix or cscript on Windows. Because the javaOpts parameter is concatenated into that string without quoting or escaping, the shell parses it as part of the command rather than as JVM arguments.

Any shell metacharacter contained in javaOpts is interpreted by the shell. Characters including ;, |, backticks, and $(...) enable command substitution and chaining. The injected commands execute with the privileges of the Karaf process account.

The flaw is reachable through multiple entry points. Operators invoke it through shell commands such as instance:create, instance:start, instance:restart, and instance:change-opts. Remote attackers with JMX access can reach the equivalent InstanceMBean operations createInstance, startInstance, changeJavaOpts, and cloneInstance. The vulnerability requires authentication, but any principal mapped to a role allowed to invoke these commands can exploit it.

Root Cause

The root cause is unsafe command construction in InstanceServiceImpl. The service builds a shell command through string concatenation instead of passing arguments as a safely-separated ProcessBuilder argv array. The javaOpts field is treated as trusted operator input, but no validation, quoting, or escaping is applied before it reaches the shell interpreter.

Attack Vector

An attacker authenticates to the Karaf shell or JMX endpoint using any account with permission to invoke instance:* commands. They supply a javaOpts value containing shell metacharacters, for example appending ; <command> or using $(<command>) substitution. When the instance service executes the composed command through /bin/sh, the injected payload runs as a separate process under the Karaf user account. This provides a foothold for lateral movement, credential theft, or persistence on the host.

See the Apache Security Mailing List Thread and the OpenWall OSS-Security Update for additional technical context.

Detection Methods for CVE-2026-91006

Indicators of Compromise

Karaf audit logs containing instance:create, instance:start, instance:restart, or instance:change-opts invocations with javaOpts values that include ;, |, backticks, or $( sequences.
Unexpected child processes spawned by the Karaf JVM user, particularly shells, network utilities, or interpreters unrelated to Java.
JMX access logs showing calls to createInstance, startInstance, changeJavaOpts, or cloneInstance from unexpected principals or source addresses.

Detection Strategies

Parse Karaf command history and JMX audit logs for javaOpts arguments that contain shell metacharacters outside the expected -D, -X, and -javaagent: option patterns.
Alert on process-tree anomalies where the Karaf JVM parents non-JVM processes such as /bin/sh, bash, curl, wget, nc, or powershell.exe.
Correlate authenticated Karaf sessions with downstream process creation events to attribute injected commands to originating users.

Monitoring Recommendations

Enable Karaf command audit logging and forward events to a centralized analytics platform for retention and search.
Monitor the Karaf service account for outbound network connections and file writes outside its normal working directories.
Track changes to etc/users.properties, etc/system.properties, and etc/jmx.acl.*.cfg for unauthorized role modifications.

How to Mitigate CVE-2026-91006

Immediate Actions Required

Set karaf.secured.command.compulsory.roles=admin in etc/system.properties to close the fail-open gap for all unconfigured command scopes.
Restrict which principals can reach instance:* commands and InstancesMBean by tightening role assignments in etc/users.properties.
Treat any javaOpts input passed to instance:create, instance:start, instance:change-opts, or InstancesMBean as untrusted unless submitted by fully-trusted operators.
Audit existing Karaf accounts and remove unused principals or roles that currently grant access to instance management.

Patch Information

Refer to the Apache Security Mailing List Thread and the OpenWall OSS-Security Update for the current fixed-version guidance from the Apache Karaf project. Upgrade to the vendor-recommended patched release once available in your deployment channel.

Workarounds

Enforce karaf.secured.command.compulsory.roles=admin so unconfigured command scopes require the admin role by default.
Limit JMX exposure by binding the management connector to localhost and placing it behind authenticated, network-segmented access.
Remove the manager and admin roles from any service accounts that do not require instance-management privileges.

bash

# Configuration example - etc/system.properties
karaf.secured.command.compulsory.roles=admin

# Example role tightening in etc/jmx.acl.org.apache.karaf.instance.cfg
createInstance = admin
startInstance = admin
changeJavaOpts = admin
cloneInstance = admin