CVE-2026-91048: Apache Karaf JDBC Shell Command RCE Vulnerability

CVE-2026-91048 Overview

CVE-2026-91048 is a privilege escalation to remote code execution vulnerability in Apache Karaf's shell command access control layer. The jdbc shell command scope ships without a corresponding org.apache.karaf.command.acl.jdbc.cfg policy file. Karaf's SecuredSessionFactoryImpl treats any command lacking a matching ACL rule as permitted. Any authenticated shell user, including accounts holding only the viewer role, can invoke every jdbc:* command. The same missing-ACL condition affects jms:* shell commands. The vulnerability is classified as [CWE-862] Missing Authorization.

Critical Impact
A viewer-role shell user can invoke jdbc:ds-create with an attacker-controlled JDBC URL, trigger driver-side code execution (for example H2 INIT=RUNSCRIPT), and bypass the admin-role gate that protects shell:exec.

Affected Products

Apache Karaf (shell command ACL subsystem)
Karaf jdbc shell command scope
Karaf jms shell command scope

Discovery Timeline

2026-09-29 - CVE-2026-91048 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-91048

Vulnerability Analysis

Apache Karaf enforces role-based access control on shell commands through SecuredSessionFactoryImpl. The framework loads per-scope ACL configurations from files named org.apache.karaf.command.acl.<scope>.cfg. When no ACL file exists for a scope, the guard defaults to allow rather than deny. The jdbc scope ships without such a configuration file. Every command under jdbc:* becomes reachable by any authenticated shell session regardless of the assigned role.

The jdbc:ds-create command accepts a JDBC URL and writes it into a pax-jdbc-config factory Configuration with no validation. The pax-jdbc-config bundle reacts to the new configuration and instantiates a live DataSource. Several JDBC drivers execute code or SQL at connection time based on URL parameters. The H2 driver interprets INIT=RUNSCRIPT to run arbitrary SQL scripts, which can be chained into arbitrary code execution.

The result is a full privilege escalation chain. A viewer account, which is normally blocked from running shell:exec, can reach code execution by pivoting through jdbc:ds-create. The jms:* scope exhibits the same missing-ACL condition and the same class of driver-side abuse.

Root Cause

The root cause is a fail-open authorization policy combined with a missing configuration artifact. The command guard grants access when no rule matches, and the shipped distribution omits org.apache.karaf.command.acl.jdbc.cfg and the equivalent jms file. Together these produce a Missing Authorization defect under [CWE-862].

Attack Vector

An attacker authenticates to the Karaf shell with any low-privilege role such as viewer. The attacker invokes jdbc:ds-create and supplies a crafted JDBC URL pointing at a driver that executes logic at connection time. When pax-jdbc-config materializes the DataSource, the driver processes the URL and runs attacker-controlled logic in the Karaf JVM. The attacker inherits the privileges of the Karaf process, bypassing the admin-only restriction on shell:exec.

See the Apache Security Mailing List Thread and the Openwall OSS-Security Discussion for the coordinated disclosure details.

Detection Methods for CVE-2026-91048

Indicators of Compromise

Shell audit entries showing jdbc:ds-create or jdbc:ds-* invocations by non-admin principals.
New or unexpected files under the Karaf etc/ directory matching the pattern org.ops4j.datasource-*.cfg.
Outbound connections from the Karaf JVM to unfamiliar database hosts immediately after a jdbc:* command.
JDBC URLs containing driver directives such as INIT=RUNSCRIPT, MODE=, or references to remote script files.

Detection Strategies

Enable Karaf shell command auditing and alert on any jdbc:* or jms:* command executed by users lacking the admin or manager role.
Monitor the Karaf etc/ directory for creation of org.ops4j.datasource-*.cfg files outside change windows.
Inspect JVM child processes spawned by the Karaf process for shells, scripting interpreters, or network utilities.

Monitoring Recommendations

Forward Karaf shell logs and OSGi configuration events into a centralized log platform for correlation.
Baseline the set of legitimate DataSource factory configurations and alert on drift.
Track authentication activity against the Karaf SSH shell (default port 8101) and flag interactive sessions from non-admin accounts.

How to Mitigate CVE-2026-91048

Immediate Actions Required

Restrict network access to the Karaf shell (SSH port 8101 and JMX) to trusted administrative hosts only.
Remove or downgrade all shell accounts that do not require operational access, and audit role assignments for the viewer, manager, and admin groups.
Deploy explicit ACL configuration files for the jdbc and jms command scopes that limit those commands to admin role holders.
Review Karaf audit logs for prior invocation of jdbc:ds-create or jms:* commands by non-admin users.

Patch Information

Apache has coordinated disclosure through the project security list. Refer to the Apache Security Mailing List Thread for the fixed release identifiers and upgrade guidance, and to the Openwall OSS-Security Discussion for advisory context. Upgrade to the fixed Karaf release once available and redeploy with the shipped ACL configuration files present.

Workarounds

Create etc/org.apache.karaf.command.acl.jdbc.cfg and etc/org.apache.karaf.command.acl.jms.cfg that explicitly require the admin role for every command in those scopes.
Uninstall the pax-jdbc-config feature if runtime DataSource creation is not required.
Restrict the JDBC drivers available on the Karaf classpath to vetted drivers, and remove drivers such as H2 that execute logic at connection time when not needed.
Enforce network egress controls on the Karaf host to block outbound database and HTTP connections to untrusted destinations.

bash

# Example ACL entry limiting jdbc:* commands to admin role
# File: etc/org.apache.karaf.command.acl.jdbc.cfg
jdbc\:.* = admin

# Equivalent enforcement for jms:* commands
# File: etc/org.apache.karaf.command.acl.jms.cfg
jms\:.* = admin