Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Karaf

15 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-91085

    Apache Karaf: config:install missing ACL entry allows privilege escalation to admin

    Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg). SecuredSessionFactoryImpl.checkSecurity() resolves the roles required for an invocation and, when no ACL rule matches th…

    Apache Software Foundation Apache Karaf
  • Medium 5.3
    CVE-2022-22932 Public exploit

    Path traversal flaws

    Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: htt…

    Apache Software Foundation Apache Karaf org.apache.karaf:apache-karaf Maven
  • Medium 6.5
    CVE-2016-8750

    Moderate severity vulnerability that affects org.apache.karaf:apache-karaf

    Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.

    Apache Software Foundation Apache Karaf org.apache.karaf:apache-karaf Maven