What’s Vulnerable › Products

Apache Software Foundation Apache Karaf vulnerabilities

19 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Apache Software Foundation Apache Karaf version is affected

Latest Apache Software Foundation Apache Karaf vulnerabilities

• CVE-2026-92142 — Apache Karaf: Authorization bypass in JMX MBean lifecycle operations (CVSS 8.8)
• CVE-2026-91085 — Apache Karaf: config:install missing ACL entry allows privilege escalation to admin (CVSS 6.3)
• CVE-2026-91048 — Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create (CVSS 9.8)
• CVE-2026-91012 — Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation (CVSS 9.8)
• CVE-2026-91006 — Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) (CVSS 8.8)
• CVE-2026-90979 — Apache Karaf: LDAP filter injection in JAAS LDAP login modules (CVSS 7.3)
• CVE-2026-92230 — Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching (CVSS 7.5)
• CVE-2022-40145 — Apache Karaf: JDBC JAAS LDAP injection (CVSS 9.8)
• CVE-2022-22932 — Path traversal flaws (CVSS 5.3)
• CVE-2021-41766 — Insecure Java Deserialization in Apache Karaf (CVSS 8.1)
• CVE-2020-28052 — (CVSS 8.1)
• CVE-2020-11980 — (CVSS 6.3)
• CVE-2019-0226 — (CVSS 4.9)
• CVE-2019-0191 — (CVSS 6.5)
• CVE-2018-11788 — (CVSS 9.8)
• CVE-2018-11787 — (CVSS 8.1)
• CVE-2018-11786 — (CVSS 8.8)
• CVE-2016-8750 — (CVSS 6.5)
• CVE-2014-0219 — (CVSS 5.5)