CVE-2018-11786

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-18 · updated 2026-06-17
Weakness: CWE-269

Description

In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. This can be locked down a bit by using chroot to change the root directory to protect files outside of the Karaf install directory; it can be further locked down by defining a security manager policy that limits file system access to those directories beneath the Karaf home that are necessary for the system to run. However, this still allows anyone with ssh access to the Karaf process to read and write a large number of files as the Karaf process user.

Affected products

Apache Software Foundation Apache Karaf: before 4.2.0 — fixed in 4.2.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Karaf 4.2.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-11786 or the next vulnerability affects your stack