Apache Karaf uses per-scope ACL files to enforce command access. The config:install command was missing an ACL entry, causing the ACL resolver to fall back to an open (pass‑check) path when no rule matched. As a result, any authenticated user could invoke config:install and deploy arbitrary configuration files into the Karaf etc directory. These files include security‑related properties and other ACL definitions, allowing the attacker to modify or overwrite ACL files, thereby granting themselves administrative privileges. The flaw fundamentally breaks the intended isolation between ordinary users and privileged administrative operations, leading to full control of the Karaf instance.

The affected product is the Apache Karaf container from the Apache Software Foundation. The flaw exists in the default command ACL configuration (etc/org.apache.karaf.command.acl.config.cfg) and the general shell/SSH command‑execution machinery. No specific version numbers are listed in the advisory, so any installation of Apache Karaf that retains the shipped ACL configuration without a later patch is susceptible.

Because an attacker only needs to be an authenticated user with access to the Karaf shell or SSH, the exploit requires no elevated privileges or additional software. The EPSS score is listed as <1%, indicating a very low probability of real‑world exploitation, yet the impact is severe when the vulnerability is present. The CVSS score of 6.3 (medium severity) reflects the vulnerability’s potential for privilege escalation via unrestricted command execution. The issue is not listed in the CISA KEV catalog, so no proven public exploits are documented as of the data available.