CVE-2021-41766

Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated deserialization attacks, the implementation used by Apache Karaf is not protected against this kind of attack. The impact of Java deserialization vulnerabilities strongly depends on the classes that are available within the targets class path. Generally speaking, deserialization of untrusted data does always represent a high security risk and should be prevented. The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder).

• CWE-502

• https://karaf.apache.org/security/cve-2021-41766.txtVendor Advisory
• https://karaf.apache.org/security/cve-2021-41766.txtVendor Advisory

Published

Jan 26, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41754dynamicMarkt <= 3.10 is affected by SQL injection in the par…9.8
• CVE-2021-41755dynamicMarkt <= 3.10 is affected by SQL injection in the kat…9.8
• CVE-2021-41756dynamicMarkt <= 3.10 is affected by SQL injection in the kat…9.8
• CVE-2021-4176livehelperchat is vulnerable to Improper Neutralization of I…6.1
• CVE-2021-41764A cross-site request forgery (CSRF) vulnerability exists in …8.8
• CVE-2021-41765A SQL injection issue in pages/edit_fields/9_ajax/add_keywor…9.8
• CVE-2021-41767Apache Guacamole 1.3.0 and older may incorrectly include a p…6.5
• CVE-2021-41769A vulnerability has been identified in SIPROTEC 5 6MD85 devi…7.5
• CVE-2021-4177livehelperchat is vulnerable to Generation of Error Message …5.3
• CVE-2021-41770Ping Identity PingFederate before 10.3.1 mishandles pre-pars…7.5
• CVE-2021-41771ImportedSymbols in debug/macho (for Open or OpenFat) in Go b…7.5
• CVE-2021-41772Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive…7.5