CVE-2026-91085: Apache Karaf Authentication Bypass Vulnerability

CVE-2026-91085 Overview

Apache Karaf ships an access control list (ACL) for the config:* shell and SSH commands that fails to restrict config:install. Any authenticated user, including one holding only the viewer role, can invoke the command. config:install fetches an arbitrary URL and writes the response into ${karaf.etc}, the directory that stores every security-relevant file Karaf ships. With the -o/--override flag, attackers overwrite existing files such as users.properties, keys.properties, host.key, and the ACL configuration files themselves. Felix FileInstall watches ${karaf.etc} and reloads dropped .cfg files automatically, so no restart is required to activate malicious changes.

Critical Impact
A low-privileged authenticated user can overwrite Karaf's user database, SSH host key, and ACL definitions, leading to full administrative takeover of the container.

Affected Products

Apache Karaf (shell/SSH command ACL subsystem)
Installations relying on the shipped org.apache.karaf.command.acl.config.cfg
Deployments where karaf.secured.command.compulsory.roles remains commented out in etc/system.properties

Discovery Timeline

2026-09-29 - CVE CVE-2026-91085 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-91085

Vulnerability Analysis

The flaw is a missing authorization issue [CWE-862] in Apache Karaf's command ACL enforcement. SecuredSessionFactoryImpl.checkSecurity() resolves the roles required for a command invocation. When no ACL rule matches, ACLConfigurationParser.Specificity.NO_MATCH sets passCheck = true, causing the check to fail open. The safety valve karaf.secured.command.compulsory.roles ships commented out in etc/system.properties, so unmatched commands are permitted for any authenticated user.

The shipped org.apache.karaf.command.acl.config ACL restricts delete, edit, property-*, and update to admin for security-critical persistent IDs. It allows manager for most other operations. The install verb is absent from the file entirely, so it falls through to the fail-open path.

By contrast, bundle:install, feature:install, and kar:install are all restricted to admin in their respective ACLs. config:install is the outlier.

Root Cause

Two defects combine to create the vulnerability. First, the shipped ACL for the config scope omits an install entry. Second, the parser's default behavior on NO_MATCH is to allow rather than deny, and the compulsory-roles safeguard is disabled by default.

Attack Vector

An authenticated user with any role invokes config:install <url> <finalname> over the Karaf shell or SSH. The command downloads attacker-controlled bytes from an arbitrary URL and writes them into ${karaf.etc} as finalname. PathUtils.checkWithin() blocks .. traversal outside ${karaf.etc}, but that folder contains users.properties, keys.properties, host.key, and the ACL files themselves. Using -o/--override, the attacker overwrites users.properties to add an admin account or rewrites the ACL file that governs config:install itself. Because felix.fileinstall.dir = ${karaf.etc}, Felix FileInstall reloads .cfg changes without a restart.

See the Apache Karaf CVE-2026-91085 Advisory for the full technical description.

Detection Methods for CVE-2026-91085

Indicators of Compromise

Shell or SSH audit entries showing config:install invocations from non-admin principals.
Recent modifications to etc/users.properties, etc/keys.properties, etc/host.key, or any etc/org.apache.karaf.*.acl.*.cfg file that do not correspond to change-management activity.
Outbound HTTP/HTTPS requests originating from the Karaf JVM to unexpected hosts, correlating with file writes under ${karaf.etc}.
Felix FileInstall log lines reporting reloads of unexpected .cfg files immediately after a config:install call.

Detection Strategies

Enable Karaf shell command auditing and forward karaf.log to a central log platform, filtering for config:install events by role.
Baseline the contents and hashes of files in ${karaf.etc} and alert on unauthorized changes with file integrity monitoring.
Correlate authentication events against the roles observed running config:* commands to identify privilege anomalies.

Monitoring Recommendations

Monitor for new or modified users in users.properties, especially additions granting the admin or group roles.
Watch process telemetry for the Karaf JVM initiating outbound connections to non-approved URLs at the moment configuration files change.
Track SSH sessions to the Karaf port (default 8101) and alert on interactive commands issued by service accounts.

How to Mitigate CVE-2026-91085

Immediate Actions Required

Add install = admin to etc/org.apache.karaf.command.acl.config.cfg, creating the file if it does not exist.
Set karaf.secured.command.compulsory.roles=admin in etc/system.properties and restart Karaf so unmatched commands fail closed.
Audit etc/users.properties, etc/keys.properties, etc/host.key, and all ACL .cfg files against a known-good baseline. Rotate credentials and the SSH host key if tampering is suspected.
Restrict network access to the Karaf SSH console (default port 8101) to trusted administrative networks.

Patch Information

Refer to the Apache Karaf CVE-2026-91085 Advisory for vendor-supplied fixed versions and updated ACL defaults. Additional discussion is available on the OpenWall OSS-Security list.

Workarounds

Explicitly deny config:install for non-admin roles by adding the install = admin line to the config-scope ACL.
Enable the compulsory roles safeguard so any command without a matching ACL rule requires the admin role.
Remove or disable the manager and viewer roles for any accounts that do not require them, and review Felix FileInstall settings to limit which directories are watched.

bash

# Configuration example: enforce admin-only config:install and fail-closed defaults

# 1) In etc/org.apache.karaf.command.acl.config.cfg
install = admin

# 2) In etc/system.properties
karaf.secured.command.compulsory.roles=admin