Apache Karaf 4.4.12 Tutorial: Upgrade and Harden Your Server

Apache Karaf 4.4.12 landed on September 27, 2026, and its security fixes are broader than a routine dependency refresh. The release closes several authorization and input-handling weaknesses disclosed around the same time, including issues affecting configuration writes, JDBC and JMS shell commands, LDAP filters, and Java Management Extensions (JMX) access. This Apache Karaf 4.4.12 tutorial walks through checking an existing installation, preparing a safe upgrade, replacing the runtime, and verifying the controls that matter after the restart.

Why Karaf 4.4.12 needs a security-focused upgrade

Apache Karaf is an OSGi-based application runtime that provides services such as configuration, shell access, JMX management, logging, provisioning, and an optional WebConsole. The 4.4.x series currently lists 4.4.12 as its stable release, while the older 4.3.x series remains at 4.3.10. Karaf 4.4.12 was released as a maintenance update, but the project's own release notes specifically call out security hardening rather than treating the changes as ordinary dependency maintenance.

The security advisories explain why that distinction matters. CVE-2026-91012 allowed a user with the manager role to influence configuration file paths outside the intended ${karaf.etc} directory, while CVE-2026-91048 exposed JDBC and JMS shell scopes without the expected access-control rules. CVE-2026-92142 affected JMX Model MBean lifecycle operations that were not included in the role-based authorization checks. These are different code paths, but they share a practical lesson: restricting one privileged command does not protect a Karaf installation if another management interface still accepts the same user's input without an equivalent authorization check.

Check your Karaf version before changing anything

Start by identifying the runtime you are actually operating rather than assuming the directory name reflects the installed version. Connect to the Karaf shell and run the built-in version command. The shell documentation lists version and system:version among the available commands, and the startup banner also reports the Karaf version.

version

If the result is earlier than 4.4.12 on the 4.4.x branch, treat the installation as needing review before continuing to expose its management interfaces. The Apache advisory for CVE-2026-91012 lists versions before 4.4.12 as affected, and the other September advisories for Karaf use the same fixed release. Do not confuse an application bundle's version with the Karaf runtime version; the security fixes discussed here are changes in the runtime itself.

Back up configuration and application state first

Before replacing the runtime, stop the instance cleanly and preserve the configuration and application data you depend on. A Karaf installation separates configuration under etc from working state under data, while the installation also contains scripts and deployed application material. The exact backup set depends on how your application is provisioned, so capture the complete Karaf installation or a tested equivalent rather than copying only one configuration file.

system:shutdown

Also record local changes before you replace the runtime, particularly files under etc that define users, roles, command access, JMX permissions, feature repositories, and application configuration. This matters because 4.4.12 deliberately changes several security defaults and ACL-related files, so blindly copying every old configuration file over the new installation can defeat part of the hardening. The release specifically adds command ACLs for JDBC and JMS, restricts several commands to the admin role, and adds JMX role-based checks for MBean lifecycle operations.

Install Apache Karaf 4.4.12 beside the existing runtime

Use the official 4.4.12 binary distribution that matches the operating system rather than modifying an old runtime in place. Apache publishes both ZIP and tar.gz distributions, and its current download page identifies 4.4.12 as the latest 4.4.x release. Installing the new runtime in a separate directory gives you a straightforward rollback path if an application or custom bundle behaves differently after the upgrade.

On Unix-like systems, extract the new distribution into a new installation directory and bring across only the configuration and application material you have reviewed. On Windows, use the ZIP distribution and perform the same migration with the existing service configuration taken into account. Apache's installation documentation describes the binary distributions as containing the same basic runtime content, with bin holding the platform-specific startup scripts and etc holding configuration.

bin/karaf

Do not start the new runtime with an unreviewed copy of the old etc directory simply because it makes the migration quicker. The 4.4.12 release changes command authorization and configuration-file handling specifically to close security gaps. Preserve application-specific settings, but compare security-sensitive configuration with the new distribution so that the patched defaults remain in effect.

Verify the configuration-file protection added in 4.4.12

CVE-2026-91012 was caused by configuration update paths that could construct a destination from caller-controlled values without proving that the resulting file stayed below ${karaf.etc}. The affected code backed both the configuration MBean and config: shell operations, and the advisory describes paths involving felix.fileinstall.filename and configuration PIDs containing parent-directory segments. A manager-level account therefore represented more than a normal configuration operator because the vulnerable write path could reach files outside the intended configuration directory.

After upgrading, inspect the configuration directory and confirm that your expected application configuration still resides under the Karaf configuration tree. Do not attempt to reproduce the vulnerable path against a production system merely to prove that the patch works. The useful verification is that the runtime reports 4.4.12, the configuration loads normally, and your application starts without unexpected configuration files appearing outside its intended location. The project explicitly lists keeping configuration writes within ${karaf.etc} as one of the 4.4.12 hardening changes.

Review shell roles after the JDBC and JMS ACL fixes

One of the more subtle changes in 4.4.12 concerns command authorization. CVE-2026-91048 affected the JDBC shell scope because no matching ACL rule existed, allowing authenticated shell users to reach jdbc:* commands that could create data sources from attacker-controlled JDBC URLs; the advisory says the same authorization problem applied to JMS commands. The problem was therefore not simply that a powerful JDBC command existed, but that the command scope could bypass the role boundary expected by administrators.

Review the accounts and roles used for SSH or shell access before testing application functionality. Remove unnecessary users, make sure ordinary operators do not receive administrative roles, and compare your custom command ACL configuration with the ACL files shipped by 4.4.12. The release adds explicit command ACLs for both JDBC and JMS scopes, so an old configuration can be particularly worth reviewing if it was created before these rules existed.

user-list

The goal is not to make every shell account an administrator simply because the new release has stronger checks. Karaf's security model uses roles to control console commands, the JMX layer, WebConsole, and other services, so the useful configuration is the narrow one that gives each account only the operations it actually needs.

Check JMX exposure before reopening remote management

CVE-2026-92142 makes JMX especially relevant after the upgrade. Apache Karaf's JMX layer uses role-based access control, but the affected implementation did not include createMBean, registerMBean, and unregisterMBean in the protected operation list. The advisory says the corrected release adds those lifecycle operations to the authorization checks and supplies default ACL entries restricting them to the admin role.

Before enabling or exposing remote JMX, determine whether your deployment actually needs it and restrict access to trusted management systems. The advisory identifies the JMX Remote Method Invocation registry and server ports as part of the remote management surface, so an Internet-facing management interface deserves a different review from a JMX endpoint reachable only from an internal administration network. If you must operate an older runtime temporarily, the Apache advisory recommends restricting network access to the JMX ports to trusted hosts until an upgrade can be completed.

Verify the LDAP and WebConsole hardening

Karaf 4.4.12 also addresses LDAP filter substitution and WebConsole security. CVE-2026-90979 involved values substituted into administrator-configured LDAP search filters, while the 4.4.12 release notes call out escaping for the %u, %dn, and %fqdn substitutions. The same release also fixes a WebConsole security issue and hardens its MemoryPlugin, so installations using the optional browser-based administration interface should include it in their post-upgrade checks.

If your deployment uses LDAP-backed authentication, test both successful logins and expected role assignment after the upgrade. Do not test the LDAP fix by injecting hostile filter syntax into a production directory; use a controlled account and verify that normal usernames, distinguished names, and group-to-role mappings continue to resolve correctly. For WebConsole deployments, verify that the console loads, authentication still works, and users retain only the management permissions assigned to their roles. Karaf documents WebConsole as an optional feature used to manage bundles, features, instances, configurations, and logs, which makes its access controls part of the runtime's security boundary.

Confirm the upgraded runtime before putting traffic back

Once the application starts, check the runtime version again and confirm that the expected bundles and features are active. The Karaf shell provides commands for inspecting installed bundles and features, while the runtime's version command gives you the simplest confirmation that the new installation is actually running. A successful application startup is not enough if a service manager, container definition, or symbolic link has silently started the previous installation instead.

version bundle:list feature:list -i

Next, exercise the normal application path rather than only the management console: authenticate a test user, load the application, perform one representative operation, and inspect the logs for startup or dependency failures. Pay particular attention to applications that rely on custom JDBC, JMS, LDAP, JMX, or WebConsole integrations because those are the areas where 4.4.12 changes security behavior. The release also contains dependency updates, so a clean startup followed by a small functional test gives you more evidence than checking the version string alone.

Do not stop at the version number

Karaf 4.4.12 closes several problems that came from different management surfaces sharing the same underlying assumption: an authenticated user or administrator-controlled value was trusted farther than it should have been. The configuration fix keeps writes inside the intended configuration directory, the command ACL changes put JDBC and JMS scopes behind explicit authorization, the JMX fix extends role checks to MBean lifecycle operations, and the LDAP changes sanitize substituted values before they become search filters. Taken together, those changes make the upgrade more than a version-number exercise.

After the runtime is verified, keep the old installation available only for rollback according to your normal change-management process, and make sure the active service definition points to the patched runtime. Apache currently lists 4.4.12 as the stable 4.4.x release and identifies 4.4.x as supported, while the project also lists older 4.3.x and 4.2.x branches separately. The next useful security check is therefore not simply whether Karaf starts, but whether every management path your deployment exposes still has a clear owner, a necessary role, and a restricted network boundary.