Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-srxe-9dxr-qkc4
Vulnerability ID VCID-srxe-9dxr-qkc4
Aliases CVE-2018-11786
GHSA-9448-c9wq-jg9v
Summary Improper Privilege Management In Apache Karaf, if the sshd service in Karaf is left on, an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-269 Improper Privilege Management
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-862 Missing Authorization
System Score Found at
cvssv3.1 8.8 http://karaf.apache.org/security/cve-2018-11786.txt
generic_textual HIGH http://karaf.apache.org/security/cve-2018-11786.txt
cvssv3 7.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-11786.json
epss 0.00755 https://api.first.org/data/v1/epss?cve=CVE-2018-11786
cvssv3.1 8.8 https://github.com/advisories/GHSA-9448-c9wq-jg9v
generic_textual HIGH https://github.com/advisories/GHSA-9448-c9wq-jg9v
cvssv3.1 8.8 https://issues.apache.org/jira/browse/KARAF-5427
generic_textual HIGH https://issues.apache.org/jira/browse/KARAF-5427
cvssv3.1 8.8 https://lists.apache.org/thread.html/5b7ac762c6bbe77ac5d9389f093fc6dbf196c36d788e3d7629e6c1d9@%3Cdev.karaf.apache.org%3E
generic_textual HIGH https://lists.apache.org/thread.html/5b7ac762c6bbe77ac5d9389f093fc6dbf196c36d788e3d7629e6c1d9@%3Cdev.karaf.apache.org%3E
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2018-11786
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2018-11786
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-11786.json
https://api.first.org/data/v1/epss?cve=CVE-2018-11786
https://github.com/apache/karaf/commit/24fb477ea886e8f294dedbad98d2a2c4cb2a44f9
https://issues.apache.org/jira/browse/KARAF-5427
https://lists.apache.org/thread.html/5b7ac762c6bbe77ac5d9389f093fc6dbf196c36d788e3d7629e6c1d9@%3Cdev.karaf.apache.org%3E
1631102 https://bugzilla.redhat.com/show_bug.cgi?id=1631102
CVE-2018-11786 https://nvd.nist.gov/vuln/detail/CVE-2018-11786
CVE-2018-11786.TXT http://karaf.apache.org/security/cve-2018-11786.txt
GHSA-9448-c9wq-jg9v https://github.com/advisories/GHSA-9448-c9wq-jg9v
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at http://karaf.apache.org/security/cve-2018-11786.txt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2018-11786.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/advisories/GHSA-9448-c9wq-jg9v
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://issues.apache.org/jira/browse/KARAF-5427
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://lists.apache.org/thread.html/5b7ac762c6bbe77ac5d9389f093fc6dbf196c36d788e3d7629e6c1d9@%3Cdev.karaf.apache.org%3E
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2018-11786
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.73604
EPSS Score 0.00755
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:38:15.748171+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.karaf/karaf/CVE-2018-11786.yml 38.6.0