CVE-2026-91048
Description
A flaw was found in Apache Karaf. Missing access control list (ACL) configurations for certain shell command scopes allow authenticated users with low privileges to execute administrative commands. By supplying a crafted database connection string to an unrestricted command, an attacker can trigger unsafe connection-time operations in underlying drivers. This flaw enables an authenticated user to achieve arbitrary code execution and escalate privileges.
Statement
Red Hat has evaluated this vulnerability as having an Important severity rating because authenticated users possessing only low-privilege viewer roles can escalate privileges to achieve arbitrary code execution on the underlying host. In typical deployments where administrative operations such as direct system execution are protected by role checks, missing access control list definitions for the database and messaging command scopes leave these sensitive actions exposed to all authenticated shell sessions. Consequently, a restricted user can register connection parameters that trigger unsafe initialization routines within underlying drivers, fully circumventing administrative boundaries.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Gain Privileges or Assume Identity
A user can access restricted functionality and/or sensitive information that may include administrative functionality and user accounts.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
