CVE-2026-92142
Description
A flaw was found in Apache Karaf. The application fails to enforce role-based access control (RBAC) on lifecycle operations within its remote Java Management Extensions (JMX) interface. An authenticated attacker with low privileges can invoke unguarded MBean lifecycle operations to register arbitrary components and load external classes, leading to arbitrary code execution within the application environment.
Statement
This vulnerability is rated as having Important impact because successful exploitation requires valid credentials to authenticate to the remote JMX service, though even minimal read-only permissions allow an attacker to achieve full code execution within the application runtime. The flaw primarily impacts deployments that expose remote management endpoints to untrusted networks and provision accounts with limited roles. Environments that do not expose remote JMX connectors or do not issue non-administrative JMX accounts are not susceptible to this unauthorized privilege escalation.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability,Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Read Application Data; Modify Application Data; Execute Unauthorized Code or Commands; Other
Exposing critical functionality essentially provides an attacker with the privilege level of the exposed functionality. The consequences may vary depending on the behavior of the exposed method. Typically, this could result in the modification or exposure of sensitive data or possibly even execution of arbitrary code.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
