CVE-2026-92142: Apache Karaf JMX Auth Bypass Vulnerability

CVE-2026-92142 Overview

Apache Karaf ships with a JMX MBeanServer protected by KarafMBeanServerGuard, a java.lang.reflect.Proxy that enforces role-based access control (RBAC) on remote JMX operations. The guard only checks a fixed list of operations: invoke, getAttribute, getAttributes, setAttribute, and setAttributes. Lifecycle methods createMBean, registerMBean, and unregisterMBean are forwarded to the underlying MBeanServer without any authorization check. This missing authorization flaw [CWE-862] allows an authenticated JMX client holding only the viewer role to reach remote code execution on the Karaf JVM through the standard JDK javax.management.loading.MLet classloader MBean.

Critical Impact
Any authenticated JMX user, including least-privilege viewer accounts, can achieve remote code execution against the Karaf JVM with no audit trail.

Affected Products

Apache Karaf versions prior to 4.4.12
Apache Karaf 4.5.x versions prior to 4.5.0
Default installations exposing the JMX RMI connector on ports 1099 and 44444

Discovery Timeline

2026-09-29 - CVE-2026-92142 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-92142

Vulnerability Analysis

Apache Karaf's KarafMBeanServerGuard implements RBAC by wrapping the MBeanServer in a dynamic proxy. The proxy inspects incoming method calls and applies ACL rules from etc/jmx.acl.*.cfg before forwarding them. However, the guarded operation list omits MBean lifecycle methods entirely.

A viewer-role client can therefore call createMBean("javax.management.loading.MLet", objectName) without triggering any authorization check. MLet is a standard JDK MBean that functions as a remote classloader. Its getMBeansFromURL(URL) method fetches an MLet text file from an attacker-controlled URL and loads the classes it references as new MBeans in the target JVM.

The getMBeansFromURL call itself does route through the invoke guard. However, the default etc/jmx.acl.cfg grants the viewer role a wildcard rule get* = viewer, intended for read-only getters. Because the method name begins with get, it matches this heuristic and is permitted. The result is a full remote code execution chain from a least-privileged account.

Root Cause

The root cause is missing authorization on createMBean, registerMBean, and unregisterMBean. The guarded list in MBeanInvocationHandler never included them, so calls bypass RBAC entirely. Compounding this, log entries in KarafMBeanServerGuard only fire on the RBAC-denial path, so successful bypass leaves no audit trail.

Attack Vector

An attacker authenticates to the JMX endpoint using any valid credentials, including a viewer account. The attacker calls mbs.createMBean("javax.management.loading.MLet", objectName) to register an MLet instance. Next, the attacker invokes getMBeansFromURL pointing at http://attacker/mlet.txt. The Karaf JVM fetches the file, downloads the referenced JARs, and instantiates the listed classes as new MBeans, executing attacker-supplied code. The attacker then calls unregisterMBean(objectName) to remove the artifact, again without RBAC check or audit log.

See the Apache Karaf CVE-2026-92142 Advisory for the full proof-of-concept description.

Detection Methods for CVE-2026-92142

Indicators of Compromise

Outbound HTTP or HTTPS connections from the Karaf JVM to unexpected hosts, corresponding to MLet file retrieval
New MBean registrations of type javax.management.loading.MLet in JMX inventory
JMX authentication events for viewer or other low-privileged roles followed by JVM child process creation or class loading spikes
Unexplained JAR downloads landing in the Karaf process working directory or temporary paths

Detection Strategies

Monitor JMX RMI ports 1099 and 44444 for connections originating outside expected management networks
Enable JVM class loading auditing (-verbose:class) in non-production tiers to surface classes loaded via MLet
Correlate authentication events in etc/users.properties or LDAP with subsequent MBean lifecycle activity
Alert on any createMBean or unregisterMBean operation observed in JMX telemetry, since the vulnerable versions log nothing for these calls

Monitoring Recommendations

Capture network flows to and from Karaf hosts and baseline expected JMX client IP addresses
Forward JVM garbage collector, class loader, and Karaf karaf.log output to a centralized log platform for correlation
Track process trees rooted in the Karaf JVM for unexpected child processes or shell invocations

How to Mitigate CVE-2026-92142

Immediate Actions Required

Upgrade Apache Karaf to version 4.4.12, 4.5.0, or later once released
Restrict network access to JMX RMI ports 1099 and 44444 using host firewalls or network ACLs, permitting only trusted management hosts
Audit etc/users.properties and remove or rotate credentials for any non-admin JMX accounts
Review the default get* = viewer ACL rule in etc/jmx.acl.cfg and replace it with explicit per-method entries

Patch Information

The fix adds createMBean, registerMBean, and unregisterMBean to the guarded operation list. It resolves required roles for these operations from the jmx.acl* configuration using the ObjectName and, for createMBean and registerMBean, the target MBean class name. The patched default etc/jmx.acl.cfg restricts all three operations to the admin role. Deployments can also add class-name-specific rules such as createMBean(java.lang.String)[/javax\.management\.loading\..*/] = admin. Full details are available in the Apache Karaf CVE-2026-92142 Advisory and the OpenWall OSS-Security Discussion.

Workarounds

Firewall JMX RMI registry and server ports (1099 and 44444) to trusted management hosts only
Do not issue non-admin JMX credentials until the upgrade is applied
Disable the remote JMX connector entirely in etc/org.apache.karaf.management.cfg if remote management is not required

bash

# Configuration example: restrict JMX MBean lifecycle operations to admin
# Add to etc/jmx.acl.cfg after upgrade
createMBean = admin
registerMBean = admin
unregisterMBean = admin
createMBean(java.lang.String)[/javax\.management\.loading\..*/] = admin