CVE-2026-91006

Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value containing shell metacharacters (;, |, `, $(...)) is interpreted by the shell instead of being passed to the JVM as an option, giving arbitrary OS command execution as the Karaf process user. Reachable via the shell commands instance:create, instance:start, instance:restart, instance:change-opts, and the equivalent InstanceMBean JMX operations (createInstance, startInstance, changeJavaOpts, cloneInstance). Mitigation  * Set karaf.secured.command.compulsory.roles=admin in etc/system.properties to close the fail-open gap for all unconfigured command scopes. * Restrict which principals can reach instance:* commands and InstancesMBean via etc/users.properties role assignments. * Treat javaOpts passed to instance:create/instance:start/instance:change-opts/InstancesMBean as untrusted input only from fully-trusted operators.

• CWE-78

• https://lists.apache.org/thread/olzy0yjw82b20w59vonfjr1x7v5yzocr
• https://www.openwall.com/lists/oss-security/2026/09/28/3

Published

Sep 28, 2026

Last Modified

Sep 29, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9100The MongoDB C Driver's legacy GridFS API accepts malformed f…7.1
• CVE-2026-91001A security flaw has been discovered in D-Link DI-8400 16.07.…9.9
• CVE-2026-91002A weakness has been identified in stamparm maltrail up to 3.…5.3
• CVE-2026-91003A flaw has been found in D-Link DI-8300 16.07. The affected …9.1
• CVE-2026-91004A vulnerability has been found in SourceCodester Online Facu…7.3
• CVE-2026-91005A vulnerability was found in SourceCodester Online Faculty C…6.3
• CVE-2026-91008The Event Booking Manager for WooCommerce WordPress plugin …3.7
• CVE-2026-91009The Active Woot Products Tables for WooCommerce. 100% FREE  …4.3
• CVE-2026-9101Prototype pollution in csv parsing logic during import can l…4.3
• CVE-2026-91010The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative fo…4.3
• CVE-2026-91011The EWWW Image Optimizer WordPress plugin before 8.7.7 does …6.8
• CVE-2026-91014The Realtyna Organic IDX plugin + WPL Real Estate WordPress …7.1