Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into that string unquoted. A javaOpts value containing shell metacharacters (;, |, `, $(...)) is interpreted by the shell instead of being passed to the JVM as an option, giving arbitrary OS command execution as the Karaf process user. Reachable via the shell commands instance:create, instance:start, instance:restart, instance:change-opts, and the equivalent InstanceMBean JMX operations (createInstance, startInstance, changeJavaOpts, cloneInstance). Mitigation  * Set karaf.secured.command.compulsory.roles=admin in etc/system.properties to close the fail-open gap for all unconfigured command scopes. * Restrict which principals can reach instance:* commands and InstancesMBean via etc/users.properties role assignments. * Treat javaOpts passed to instance:create/instance:start/instance:change-opts/InstancesMBean as untrusted input only from fully-trusted operators.

• https://lists.apache.org/thread/olzy0yjw82b20w59vonfjr1x7v5yzocr
• http://www.openwall.com/lists/oss-security/2026/09/28/3

• Apache » Karaf » Version: 2.0.0
  cpe:2.3:a:apache:karaf:2.0.0
• Apache » Karaf » Version: 2.1.0
  cpe:2.3:a:apache:karaf:2.1.0
• Apache » Karaf » Version: 2.1.1
  cpe:2.3:a:apache:karaf:2.1.1
• Apache » Karaf » Version: 2.1.2
  cpe:2.3:a:apache:karaf:2.1.2
• Apache » Karaf » Version: 2.1.3
  cpe:2.3:a:apache:karaf:2.1.3
• Apache » Karaf » Version: 2.1.4
  cpe:2.3:a:apache:karaf:2.1.4
• Apache » Karaf » Version: 2.1.5
  cpe:2.3:a:apache:karaf:2.1.5
• Apache » Karaf » Version: 2.1.6
  cpe:2.3:a:apache:karaf:2.1.6
• Apache » Karaf » Version: 2.2.0
  cpe:2.3:a:apache:karaf:2.2.0
• Apache » Karaf » Version: 2.2.1
  cpe:2.3:a:apache:karaf:2.2.1
• Apache » Karaf » Version: 2.2.10
  cpe:2.3:a:apache:karaf:2.2.10
• Apache » Karaf » Version: 2.2.11
  cpe:2.3:a:apache:karaf:2.2.11
• Apache » Karaf » Version: 2.2.2
  cpe:2.3:a:apache:karaf:2.2.2
• Apache » Karaf » Version: 2.2.3
  cpe:2.3:a:apache:karaf:2.2.3
• Apache » Karaf » Version: 2.2.4
  cpe:2.3:a:apache:karaf:2.2.4
• Apache » Karaf » Version: 2.2.5
  cpe:2.3:a:apache:karaf:2.2.5
• Apache » Karaf » Version: 2.2.6
  cpe:2.3:a:apache:karaf:2.2.6
• Apache » Karaf » Version: 2.2.7
  cpe:2.3:a:apache:karaf:2.2.7
• Apache » Karaf » Version: 2.2.8
  cpe:2.3:a:apache:karaf:2.2.8
• Apache » Karaf » Version: 2.2.9
  cpe:2.3:a:apache:karaf:2.2.9
• Apache » Karaf » Version: 2.3.0
  cpe:2.3:a:apache:karaf:2.3.0
• Apache » Karaf » Version: 2.3.1
  cpe:2.3:a:apache:karaf:2.3.1
• Apache » Karaf » Version: 2.3.10
  cpe:2.3:a:apache:karaf:2.3.10
• Apache » Karaf » Version: 2.3.11
  cpe:2.3:a:apache:karaf:2.3.11
• Apache » Karaf » Version: 2.3.12
  cpe:2.3:a:apache:karaf:2.3.12
• Apache » Karaf » Version: 2.3.2
  cpe:2.3:a:apache:karaf:2.3.2
• Apache » Karaf » Version: 2.3.3
  cpe:2.3:a:apache:karaf:2.3.3
• Apache » Karaf » Version: 2.3.4
  cpe:2.3:a:apache:karaf:2.3.4
• Apache » Karaf » Version: 2.3.5
  cpe:2.3:a:apache:karaf:2.3.5
• Apache » Karaf » Version: 2.3.6
  cpe:2.3:a:apache:karaf:2.3.6
• Apache » Karaf » Version: 2.3.7
  cpe:2.3:a:apache:karaf:2.3.7
• Apache » Karaf » Version: 2.3.8
  cpe:2.3:a:apache:karaf:2.3.8
• Apache » Karaf » Version: 2.3.9
  cpe:2.3:a:apache:karaf:2.3.9
• Apache » Karaf » Version: 2.4.0
  cpe:2.3:a:apache:karaf:2.4.0
• Apache » Karaf » Version: 2.4.1
  cpe:2.3:a:apache:karaf:2.4.1
• Apache » Karaf » Version: 2.4.2
  cpe:2.3:a:apache:karaf:2.4.2
• Apache » Karaf » Version: 2.4.3
  cpe:2.3:a:apache:karaf:2.4.3
• Apache » Karaf » Version: 2.4.4
  cpe:2.3:a:apache:karaf:2.4.4
• Apache » Karaf » Version: 2.7.0
  cpe:2.3:a:apache:karaf:2.7.0
• Apache » Karaf » Version: 3.0.0
  cpe:2.3:a:apache:karaf:3.0.0
• Apache » Karaf » Version: 3.0.1
  cpe:2.3:a:apache:karaf:3.0.1
• Apache » Karaf » Version: 3.0.2
  cpe:2.3:a:apache:karaf:3.0.2
• Apache » Karaf » Version: 3.0.3
  cpe:2.3:a:apache:karaf:3.0.3
• Apache » Karaf » Version: 3.0.4
  cpe:2.3:a:apache:karaf:3.0.4
• Apache » Karaf » Version: 3.0.5
  cpe:2.3:a:apache:karaf:3.0.5
• Apache » Karaf » Version: 3.0.6
  cpe:2.3:a:apache:karaf:3.0.6
• Apache » Karaf » Version: 3.0.7
  cpe:2.3:a:apache:karaf:3.0.7
• Apache » Karaf » Version: 3.0.8
  cpe:2.3:a:apache:karaf:3.0.8
• Apache » Karaf » Version: 3.0.9
  cpe:2.3:a:apache:karaf:3.0.9
• Apache » Karaf » Version: 4.0.0
  cpe:2.3:a:apache:karaf:4.0.0
• Apache » Karaf » Version: 4.0.1
  cpe:2.3:a:apache:karaf:4.0.1
• Apache » Karaf » Version: 4.0.10
  cpe:2.3:a:apache:karaf:4.0.10
• Apache » Karaf » Version: 4.0.2
  cpe:2.3:a:apache:karaf:4.0.2
• Apache » Karaf » Version: 4.0.3
  cpe:2.3:a:apache:karaf:4.0.3
• Apache » Karaf » Version: 4.0.4
  cpe:2.3:a:apache:karaf:4.0.4
• Apache » Karaf » Version: 4.0.5
  cpe:2.3:a:apache:karaf:4.0.5
• Apache » Karaf » Version: 4.0.6
  cpe:2.3:a:apache:karaf:4.0.6
• Apache » Karaf » Version: 4.0.7
  cpe:2.3:a:apache:karaf:4.0.7
• Apache » Karaf » Version: 4.0.8
  cpe:2.3:a:apache:karaf:4.0.8
• Apache » Karaf » Version: 4.0.9
  cpe:2.3:a:apache:karaf:4.0.9
• Apache » Karaf » Version: 4.1.0
  cpe:2.3:a:apache:karaf:4.1.0
• Apache » Karaf » Version: 4.1.1
  cpe:2.3:a:apache:karaf:4.1.1
• Apache » Karaf » Version: 4.1.2
  cpe:2.3:a:apache:karaf:4.1.2
• Apache » Karaf » Version: 4.1.3
  cpe:2.3:a:apache:karaf:4.1.3
• Apache » Karaf » Version: 4.1.4
  cpe:2.3:a:apache:karaf:4.1.4
• Apache » Karaf » Version: 4.1.5
  cpe:2.3:a:apache:karaf:4.1.5
• Apache » Karaf » Version: 4.1.6
  cpe:2.3:a:apache:karaf:4.1.6
• Apache » Karaf » Version: 4.1.7
  cpe:2.3:a:apache:karaf:4.1.7
• Apache » Karaf » Version: 4.2.0
  cpe:2.3:a:apache:karaf:4.2.0
• Apache » Karaf » Version: 4.2.1
  cpe:2.3:a:apache:karaf:4.2.1
• Apache » Karaf » Version: 4.2.10
  cpe:2.3:a:apache:karaf:4.2.10
• Apache » Karaf » Version: 4.2.11
  cpe:2.3:a:apache:karaf:4.2.11
• Apache » Karaf » Version: 4.2.12
  cpe:2.3:a:apache:karaf:4.2.12
• Apache » Karaf » Version: 4.2.13
  cpe:2.3:a:apache:karaf:4.2.13
• Apache » Karaf » Version: 4.2.14
  cpe:2.3:a:apache:karaf:4.2.14
• Apache » Karaf » Version: 4.2.15
  cpe:2.3:a:apache:karaf:4.2.15
• Apache » Karaf » Version: 4.2.2
  cpe:2.3:a:apache:karaf:4.2.2
• Apache » Karaf » Version: 4.2.3
  cpe:2.3:a:apache:karaf:4.2.3
• Apache » Karaf » Version: 4.2.4
  cpe:2.3:a:apache:karaf:4.2.4
• Apache » Karaf » Version: 4.2.5
  cpe:2.3:a:apache:karaf:4.2.5
• Apache » Karaf » Version: 4.2.9
  cpe:2.3:a:apache:karaf:4.2.9
• Apache » Karaf » Version: 4.3.0
  cpe:2.3:a:apache:karaf:4.3.0
• Apache » Karaf » Version: 4.3.1
  cpe:2.3:a:apache:karaf:4.3.1
• Apache » Karaf » Version: 4.3.2
  cpe:2.3:a:apache:karaf:4.3.2
• Apache » Karaf » Version: 4.3.3
  cpe:2.3:a:apache:karaf:4.3.3
• Apache » Karaf » Version: 4.3.4
  cpe:2.3:a:apache:karaf:4.3.4
• Apache » Karaf » Version: 4.3.5
  cpe:2.3:a:apache:karaf:4.3.5
• Apache » Karaf » Version: 4.3.6
  cpe:2.3:a:apache:karaf:4.3.6
• Apache » Karaf » Version: 4.3.7
  cpe:2.3:a:apache:karaf:4.3.7
• Apache » Karaf » Version: 4.3.8
  cpe:2.3:a:apache:karaf:4.3.8
• Apache » Karaf » Version: 4.4.0
  cpe:2.3:a:apache:karaf:4.4.0
• Apache » Karaf » Version: 4.4.1
  cpe:2.3:a:apache:karaf:4.4.1
• Apache » Karaf » Version: 4.4.10
  cpe:2.3:a:apache:karaf:4.4.10
• Apache » Karaf » Version: 4.4.11
  cpe:2.3:a:apache:karaf:4.4.11
• Apache » Karaf » Version: 4.4.2
  cpe:2.3:a:apache:karaf:4.4.2
• Apache » Karaf » Version: 4.4.3
  cpe:2.3:a:apache:karaf:4.4.3
• Apache » Karaf » Version: 4.4.4
  cpe:2.3:a:apache:karaf:4.4.4
• Apache » Karaf » Version: 4.4.5
  cpe:2.3:a:apache:karaf:4.4.5
• Apache » Karaf » Version: 4.4.6
  cpe:2.3:a:apache:karaf:4.4.6
• Apache » Karaf » Version: 4.4.7
  cpe:2.3:a:apache:karaf:4.4.7
• Apache » Karaf » Version: 4.4.8
  cpe:2.3:a:apache:karaf:4.4.8
• Apache » Karaf » Version: 4.4.9
  cpe:2.3:a:apache:karaf:4.4.9