CVE-2026-92142: Apache Karaf: Authorization bypass in JMX MBean lifecycle operations

As cited

Copy frozen at 2026-09-28 18:31 UTC (site build).

vulnerabilities

CVE-2026-92142: Apache Karaf: Authorization bypass in JMX MBean lifecycle operations

Apache Karaf before version 4.4.12 contains an authorization bypass vulnerability in its JMX MBean lifecycle operations. The KarafMBeanServerGuard, which enforces role-based access control (RBAC) on remote JMX operations over the default-enabled RMI registry and server on ports 1099 and 44444, fails to protect a fixed list of MBean operations.

Why it matters: Organizations running Apache Karaf versions before 4.4.12 with JMX enabled should prioritize patching to prevent unauthorized remote access to MBean operations that bypass role-based access controls.

Source published

2026-09-28 17:11 UTC

First seen by Cybersecurity Tracker

2026-09-28 17:32 UTC