IBM WebSphere Application Server Liberty: Improper access control in gRPC methods
Summary
IBM WebSphere Application Server Liberty versions 20.0.0.12 through 26.0.0.10 contain an improper access control flaw in gRPC service methods when the grpc-1.0 feature is enabled. An unauthenticated remote attacker can bypass access controls configured on these methods over the network, without user interaction. IBM rates the issue CVSS 9.1 (Critical) with high confidentiality and integrity impact. The vendor bulletin lists no known exploitation at the time of publication.
Affected
- IBM WebSphere Application Server Liberty 20.0.0.12 through 26.0.0.10 with grpc-1.0 enabled
- Systems without grpc-1.0 are not listed as affected in the vendor bulletin
Fixed in
- Interim fix for APAR DT502929 (after the minimum fix pack level it requires)
- Liberty Fix Pack 26.0.0.11 or later (targeted availability 4Q2026)
Workaround
- None documented by IBM. The vendor bulletin lists no workaround other than the interim fix or fix pack.
Exploitation
- IBM and CISA SSVC data: no known exploitation (Exploitation: none, Automatable: no, Technical Impact: total).
- No confirmed public proof-of-concept code at the time of research.
Our recommendation
- Check whether grpc-1.0 is enabled in the featureManager element of server.xml.
- If grpc-1.0 is enabled, apply the interim fix for DT502929 or upgrade to Fix Pack 26.0.0.11 or later as soon as it is available.
- Until patched, restrict network access to Liberty gRPC endpoints at the firewall or reverse proxy.
- If grpc-1.0 is not needed, remove it and test the change first.
- Review the related CVE-2026-95695 and CVE-2026-95696 in the same IBM bulletin.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin: Liberty is affected by multiple vulnerabilities (CVE-2026-93895, CVE-2026-95695, CVE-2026-95696) www.ibm.com
- IBM recommended updates for WebSphere Application Server www.ibm.com
- IBM fix list for WebSphere Application Server Liberty www.ibm.com
- Open Liberty documentation: grpc-1.0 feature www.openliberty.io
- All-About-Security: IBM WebSphere Liberty, vier Sicherheitslücken geschlossen www.all-about-security.de
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 06:38.
Original description (NVD)
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.