org.apache.karaf:org.apache.karaf.instance.core vulnerabilities

CVEs whose affected-version data names the org.apache.karaf:org.apache.karaf.instance.core package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-91006None

today

Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)

Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts…

▾ SunlitApache Software Foundation · org.apache.karaf:org.apache.karaf.instance.corevia CVEORG