redhat/org.apache.karaf.instance.core vulnerabilities

Latest redhat/org.apache.karaf.instance.core CVEs

Newest publication first

1. CVE-2026-91006 Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)

   Published 2026-09-28

   High·CVSS 8.8 EPSS 1.1%

   Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into that string unquoted...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.