CVE-2026-91012 Overview
CVE-2026-91012 is a path traversal vulnerability in Apache Karaf's configuration repository. The flaw resides in org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the config MBean and the config:* shell commands. The method derives the target configuration file from caller-supplied input without validating that the resolved path remains inside ${karaf.etc}. Any user holding the manager role under Karaf's shipped Access Control List (ACL) can write attacker-controlled content to any file the Karaf process can write. This enables privilege escalation to the admin role and full container takeover.
Critical Impact
A manager-role user can overwrite etc/users.properties, ACL files, or org.apache.karaf.management.cfg to grant themselves administrative access and take over the Karaf container.
Affected Products
- Apache Karaf (config MBean and config:* shell commands)
- ConfigRepositoryImpl#update() code path
- ConfigRepositoryImpl#createFactoryConfiguration() code path
Discovery Timeline
- 2026-09-29 - CVE-2026-91012 published to NVD
- 2026-09-29 - Last updated in NVD database
Technical Details for CVE-2026-91012
Vulnerability Analysis
The vulnerability exists in two reachable code paths within ConfigRepositoryImpl. When a caller submits a property map containing a felix.fileinstall.filename entry, the value flows directly into a File constructor through getCfgFileFromProperty. The result can point to any absolute path the Karaf JVM is authorized to write. When that property is absent, the configuration Persistent Identifier (PID) is concatenated verbatim into the target file name via generateConfigFilename(), producing new File(karaf.etc, pid + ".cfg"). A PID containing .. segments resolves outside ${karaf.etc}. The createFactoryConfiguration() path shares the identical weakness through its factory PID and alias parameters.
Root Cause
The root cause is missing canonical path validation on user-controlled input used to construct file paths [CWE-22]. ConfigMBeanImpl.install() and the config:install shell command applied a partial finalname.contains("..") string check on their own code path. That check never propagated to ConfigRepositoryImpl.update() or createFactoryConfiguration(). The substring check also fails to block absolute paths and symlink-based escapes, leaving even the guarded path incomplete.
Attack Vector
Both vulnerable methods are reachable by any authenticated user holding the manager role under Karaf's shipped command and JMX ACL (org.apache.karaf.command.acl.conf.cfg maps update = manager). An attacker submits a crafted PID containing directory traversal sequences, or supplies a felix.fileinstall.filename property pointing to an absolute path. The Karaf process then writes attacker-controlled configuration content to sensitive targets. Overwriting etc/users.properties allows the attacker to append themselves to the admin role. Overwriting etc/org.apache.karaf.management.cfg or ACL files permits broader control of the container. See the Apache Mailing List Discussion and the Openwall OSS Security Update for the full disclosure text.
Detection Methods for CVE-2026-91012
Indicators of Compromise
- Unexpected modifications to etc/users.properties, etc/*.acl.*.cfg, or etc/org.apache.karaf.management.cfg files outside of change windows.
- New or altered .cfg files appearing outside ${karaf.etc} on filesystems accessible to the Karaf JVM.
- JMX or shell command audit entries showing config:update or config:create-factory-configuration calls from manager-role accounts with unusual PID values.
Detection Strategies
- Audit Karaf shell and JMX command logs for config:update invocations containing .., /, or \ in the PID argument.
- Inspect submitted property maps for felix.fileinstall.filename entries containing absolute paths.
- Correlate configuration write events with subsequent role membership changes in users.properties.
Monitoring Recommendations
- Enable file integrity monitoring on the entire ${karaf.etc} directory and any parent directories writable by the Karaf process.
- Forward Karaf audit logs and JMX access logs to a centralized log platform for behavioral analysis.
- Alert on role escalation events where a manager account gains admin privileges.
How to Mitigate CVE-2026-91012
Immediate Actions Required
- Restrict the manager role to trusted operators only, and remove it from any account that does not require configuration write access.
- Review etc/users.properties and ACL files for unauthorized role assignments introduced before patching.
- Disable remote JMX and SSH shell access where not operationally required, or bind them to management-only networks.
Patch Information
Refer to the Apache Mailing List Discussion for the vendor's remediation guidance and fixed versions. Upgrade to the patched Apache Karaf release once available, and validate that both ConfigRepositoryImpl#update() and createFactoryConfiguration() enforce canonical path containment within ${karaf.etc}.
Workarounds
- Tighten the shipped ACL in org.apache.karaf.command.acl.conf.cfg so that update and create-factory-configuration require the admin role rather than manager.
- Run the Karaf process under an operating system account whose write permissions are limited to ${karaf.etc} and required runtime directories.
- Deploy mandatory access control (SELinux or AppArmor) profiles that deny the Karaf JVM write access to files outside its expected data paths.
# Configuration example: restrict config write operations to the admin role
# File: etc/org.apache.karaf.command.acl.conf.cfg
update = admin
create-factory-configuration = admin
delete = admin
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
