CVE-2018-11787: Improper Authentication in Apache Karaf
Summary
CVE-2018-11787: Improper Authentication in Apache Karaf. Affects org.apache.karaf:apache-karaf across 3 version ranges.
< 3.0.9
>= 4.0.0, < 4.0.9
>= 4.1.0, < 4.1.1
Fixed in 3.0.9, 4.0.9 or 4.1.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Karaf is an open-source OSGi-based runtime container for deploying and managing applications. It provides a lightweight and flexible platform for building and running Java applications. The webconsole feature in Apache Karaf allows users to access a web-based console for managing the Karaf runtime. One component of the webconsole is the Gogo shell/console, which provides a command line interface for interacting with Karaf. However, in versions prior to 3.0.9, 4.0.9, and 4.1.1, when the Pax Web Extender Whiteboard is installed, the Gogo console becomes available at an unsecured URL, allowing unauthenticated users to access the Karaf console.
Vulnerability Detail
The vulnerability (CVE-2018-11787) in Apache Karaf allows unauthenticated users to access the Gogo console, which provides command line access to the Karaf runtime. This can lead to unauthorized access and potential compromise of the Karaf environment. The issue arises when the Pax Web Extender Whiteboard is installed, as it exposes the Gogo console at an unsecured URL. The vulnerability has a CVSS score of 8.1, indicating a high severity.
How To Fix
Latest published version: 4.4.12 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.0.93.0.9 -
>= 4.0.0, < 4.0.94.0.9 -
>= 4.1.0, < 4.1.14.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A possible workaround for this vulnerability is to restrict access to the unsecured URL by implementing additional security measures, such as configuring firewall rules or using a reverse proxy to enforce authentication. However, this workaround may not provide complete protection and it is still recommended to apply the fix mentioned above.
Conclusion
The vulnerability in Apache Karaf allows unauthenticated users to access the Gogo console, potentially leading to unauthorized access and compromise of the Karaf environment. It is recommended to apply the fix by stopping or uninstalling the Gogo plugin bundle or the Pax Web Extender Whiteboard. Additional security measures can also be implemented to restrict access to the unsecured URL. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.karaf:apache-karaf →
FAQ
Apache Karaf is an open-source OSGi-based runtime container for deploying and managing applications. It provides a lightweight and flexible platform for building and running Java applications.
The webconsole feature in Apache Karaf allows users to access a web-based console for managing the Karaf runtime. It provides a graphical interface for performing various administrative tasks.
The Gogo console is a command line interface in Apache Karaf that allows users to interact with the Karaf runtime. It provides a set of commands for managing bundles, services, and other aspects of the Karaf environment.
The Pax Web Extender Whiteboard is an optional bundle in Apache Karaf that provides support for web applications. It is part of the pax-war feature and is used by some applications to extend the functionality of the Karaf runtime.
To mitigate the vulnerability, it is recommended to manually stop or uninstall the Gogo plugin bundle that is installed with the webconsole feature. This can be done by accessing the Karaf console and executing the appropriate commands to stop or uninstall the bundle. Alternatively, the Pax Web Extender Whiteboard can be stopped or uninstalled, but this may impact the functionality of other components or applications that rely on it.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.karaf:apache-karaf.
