{"id":"CVE-2026-91048","revision":"ccc00420925c40b8aa9c873f5e109a15","records":[{"revision":"ccc00420925c40b8aa9c873f5e109a15","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-91048","aliases":[],"title":"Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create","description":"The\u00A0jdbc\u00A0shell command scope shipped no\u00A0org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command with no matching ACL rule as allowed, so any authenticated shell session (including one holding only the\u00A0viewer\u00A0role) could run every\u00A0jdbc:*\u00A0command.\u00A0jdbc:ds-create\u00A0stores a fully attacker-controlled JDBC URL into a\u00A0pax-jdbc-config\u00A0factory\u00A0Configuration\u00A0with no validation.\u00A0pax-jdbc-config\u00A0reactively turns that into a live\u00A0DataSource. Several JDBC drivers run code or SQL at connection time based on URL parameters (e.g. H2\u00A0INIT=RUNSCRIPT), so a\u00A0viewer-level shell user could reach arbitrary code execution, bypassing the\u00A0admin-role gate that already protects\u00A0shell:exec. This is a privilege-escalation-to-RCE chain, not merely an \"admin misconfiguration\".\n\n\nThe same applies to\u00A0jms:*\u00A0shell commands.","state":0,"publishedAt":"2026-09-29T08:34:47.193+00:00","modifiedAt":"2026-10-01T14:13:30.717+00:00","affected":[{"ecosystem":"Vendor product","name":"Apache Karaf","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Apache Software Foundation\",\n                    \"product\": \"Apache Karaf\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.4.12\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://lists.apache.org/thread/ph3867mxh2tft75w0o1hpn10f5mbmw32"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-91048","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-91048","identifiers":["CVE-2026-91048"]},"retained":false,"historicalAffected":[]}],"coverage":[]}