CVE-2026-11714 is a high-severity server-side request forgery (CVSS 8.5) in IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.6 when the apiDiscovery-1.0 feature is enabled. IBM recommends the interim fix for APAR PH71873, or Liberty Fix Pack 26.0.0.7 or later, and lists no workaround.
What's affected
From the IBM security bulletin and the CVE record:
- Product: IBM WebSphere Application Server Liberty, 17.0.0.3 through 26.0.0.6, only with the
apiDiscovery-1.0feature enabled. - Fix: upgrade to the minimum fix pack level that the interim fix requires, then apply the interim fix for APAR PH71873, or apply Liberty Fix Pack 26.0.0.7 or later. IBM listed 26.0.0.7 as targeted for the third quarter of 2026 at publication.
- Workarounds: IBM lists none.
- Weakness class: CWE-918 (server-side request forgery).
- Severity: CVSS 8.5, with a changed scope (S:C). The vector needs low privileges and gives High impact on confidentiality and Low impact on integrity.
- Naming note: the bulletin title calls this an authorization bypass, but the description and the CWE both say server-side request forgery. Use the CVE number, not the title, when you track it.
How to check if you're exposed
Start with the feature list, because the flaw applies only when apiDiscovery-1.0 is on.
grep -rn "apiDiscovery-1.0" <wlp_install>/usr/servers/*/
Replace the placeholder with your Liberty install path, and make sure you also read any files included from server.xml. Then read the version:
<wlp_install>/bin/productInfo version
IBM also publishes a page on how to determine if Liberty is using a specific feature, which helps with layered or generated configuration. If the version is in the 17.0.0.3 to 26.0.0.6 range and the feature is on, the server needs the fix.
What to do now
- Inventory Liberty servers and flag those with
apiDiscovery-1.0enabled. - Apply the interim fix for PH71873 after moving to the minimum fix pack level it requires, or move to Fix Pack 26.0.0.7 or later.
- If the API discovery feature is not in use, remove it from the feature list to cut exposure. IBM lists no workaround, so this is a precaution.
- Check outbound network rules from the Liberty hosts. Servers rarely need to reach internal admin services or cloud metadata addresses, and blocking them limits what a forged request can do.
- Check IBM's bulletin again before you close the ticket. The bulletin history shows a CVE update on 6 August 2026.
Why it matters
A server-side request forgery lets a user cause the server to send a request to a place of the attacker's choosing. Because the request originates from the server, it can reach services that trust local or internal callers. The CVSS scope is marked as changed here, which means the effect can reach beyond the Liberty component itself.
The vector gives High impact on confidentiality, so the concern is information that an internal service returns to the forged request. IBM does not publish the technical flow and we do not guess at it. Two cheap controls reduce the blast radius of any SSRF: limiting outbound traffic from application hosts, and turning off features you do not use.
Quick check
The title says authorization bypass. Is this SSRF or not?
The bulletin description and the CWE both say server-side request forgery. The title looks inconsistent. Track it by CVE number and apply the named APAR.
Is Liberty exposed if apiDiscovery-1.0 is not enabled?
The advisory limits the flaw to servers with that feature enabled. Still plan to take the fix pack in normal maintenance.
Sources
- Gold entry and CVE record: CVE-2026-11714.
- IBM security bulletin for CVE-2026-11714, initial publication 30 June 2026, CVE update 6 August 2026.
Last reviewed: 19 October 2026.
