Apache Karaf Cellar is a complete clustering solution for Apache Karaf Container. Cellar can be directly installed on running Karaf Container instances.
Apache Karaf Cellar suffers from an unauthenticated cluster-join vulnerability leading to remote code execution. The default hazelcast.xml enables multicast discovery and relies on a group password that Hazelcast no longer treats as an authentication control, so a network-adjacent attacker can join the cluster and publish to Cellar's distributed maps. Through the bundle event handler this causes the target nodes to install and start a bundle from an attacker-supplied URL, resulting in cross-node remote code execution. The default group policy permits this (bundle whitelist inbound "*", blacklist only "*.xml"), so any .jar URL is accepted.