-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

CVE-2026-91048: Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create

Severity: moderate 

Affected versions:

- - Apache Karaf before 4.4.12

Description:

The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the viewer role) could run every jdbc:* command. jdbc:ds-create stores a fully attacker-controlled JDBC URL into a pax-jdbc-config factory Configuration with no validation. pax-jdbc-config reactively turns that into a live DataSource. Several JDBC drivers run code or SQL at connection time based on URL parameters (e.g. H2 INIT=RUNSCRIPT), so a viewer-level shell user could reach arbitrary code execution, bypassing the admin-role gate that already protects shell:exec. This is a privilege-escalation-to-RCE chain, not merely an "admin misconfiguration".

The same applies to jms:* shell commands.

Credit:

MopMonk-AI <mopmonk-ai@tophant.com> (reporter)

References:

https://karaf.apache.org/
https://www.cve.org/CVERecord?id=CVE-2026-91048
-----BEGIN PGP SIGNATURE-----

iQJPBAEBCAA5FiEEGqjPktQJpzOT0Lc2v/LuQsgoLnYFAmq6i+EbFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMCwzAAoJEL/y7kLIKC52K5cQAJ9KdFR8N6Mia/SlxGTL
DwoklX6pvime5N+lewF6jRbHksHncA3d+BhKYXhGqjZvQewAsiQR1hadf8yeLurT
5X3oyNq9XZjEs3fnC7iFR0P9eBpB5isBA8Zmnv09lDyOdfmvKbYG8Bydx6QhMNBh
9bMxz665RRCAyh27hpAFuXsNGdx5HlA3wabInYxdIuBBRvOlYpIcz+tEyDZk4LcO
zLPd+p14Vao5eAHrASEgnFp16ZVoOdHwzj1oSXyKdGbJw8WL77VHsKoD2k95fD6O
sCACutAHlIUBmzILt1YtCmuwTXymrrJ6sOZ38a/6QfZKzwKgiHJ1jfJNDf2SsrlI
MyTWaYhoPXHLiTD2c7Pr+b1r8Yu9nC7H72sHMbHssABaHnG5oM8cON7SHt7NFRNc
ozrvuk/TZIjEMk5XN6PIPJi73QQRgTmjsCIvpksmx/V7Q6b3tftwT0p5F4Epd/YH
bZKOSLB0okT4CYMcq1dbSaMG6gv8Br/pgApEcxOwv1XzKsufKzXWpRXcwczuR29r
8wNorm8WfziKKyct6EHYPZkbQCiUA++jm+lZ1uDtJcQSRLgSVXhGtwNtpRf0YAY0
izJ+SwP/4rxD5QPaV13mTM3AHCuoStxS0bv1BSfkg7Z1kie3+NVXk7LMLKSgQKrb
dVk8M2s+azHTGO+hGtpAT9aJ
=KAg1
-----END PGP SIGNATURE-----