CVE-2026-11546 Overview
CVE-2026-11546 is a Server-Side Request Forgery (SSRF) vulnerability in IBM WebSphere Application Server Liberty. The flaw affects versions 17.0.0.3 through 26.0.0.7 when the adminCenter-1.0 feature is enabled. A remote unauthenticated attacker can send crafted requests that force the server to initiate connections to attacker-chosen destinations. Successful exploitation compromises confidentiality, integrity, and availability of the affected server and any reachable internal systems. The vulnerability is tracked as CWE-918.
Critical Impact
Unauthenticated attackers can abuse the adminCenter-1.0 feature to make the WebSphere Liberty server send arbitrary requests to internal or external endpoints, enabling reconnaissance, metadata service abuse, and pivoting to internal services.
Affected Products
- IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7
- Deployments with the adminCenter-1.0 feature enabled
- Applications and services relying on the WebSphere Liberty admin interface
Discovery Timeline
- 2026-06-30 - CVE-2026-11546 published to the National Vulnerability Database
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-11546
Vulnerability Analysis
The vulnerability resides in the adminCenter-1.0 feature of IBM WebSphere Application Server Liberty. When this feature is enabled, the server processes user-influenced URLs without sufficient validation of the target host or scheme. An attacker can supply a URL that points to internal network resources, cloud metadata endpoints, or arbitrary external hosts. The Liberty runtime then issues the outbound request on behalf of the attacker.
Because exploitation requires no authentication and no user interaction, any network-reachable Liberty instance running an affected version with the admin feature enabled is exposed. The impact extends beyond information disclosure. Attackers can reach internal services that are not directly accessible from the internet, including databases, orchestrators, and instance metadata services on cloud platforms.
Root Cause
The root cause is insufficient validation of destination URLs handled by the adminCenter-1.0 feature, matching the CWE-918 SSRF pattern. The component accepts request parameters that specify remote resources and does not enforce a strict allow-list of hosts, schemes, or IP ranges before dispatching the outbound connection.
Attack Vector
Exploitation occurs over the network against the Liberty admin interface. An attacker sends a crafted HTTP request that causes the server to fetch or interact with an attacker-controlled or internal URL. See the IBM Support Page for vendor technical details. No public proof-of-concept code is available at this time.
Detection Methods for CVE-2026-11546
Indicators of Compromise
- Outbound connections from the WebSphere Liberty JVM to unexpected internal IP ranges, loopback addresses, or link-local metadata endpoints such as 169.254.169.254.
- HTTP requests to the admin center endpoints containing URL parameters that reference private RFC1918 addresses or non-HTTP schemes.
- Unusual DNS lookups originating from the Liberty server for external attacker-controlled domains.
Detection Strategies
- Inspect Liberty messages.log and HTTP access logs for admin center requests that include URL-shaped parameters pointing to internal hosts.
- Correlate network flow data with Liberty process activity to identify server-initiated connections that deviate from baseline application behavior.
- Deploy web application firewall rules that flag admin center requests containing IP literals, file://, gopher://, or metadata hostnames.
Monitoring Recommendations
- Enable auditing on the adminCenter-1.0 feature and forward logs to a centralized SIEM for correlation.
- Monitor egress traffic from application server subnets and alert on connections to cloud metadata services from workloads that should not require them.
- Track configuration changes to server.xml that add or remove the adminCenter-1.0 feature.
How to Mitigate CVE-2026-11546
Immediate Actions Required
- Inventory all IBM WebSphere Application Server Liberty instances and identify versions in the 17.0.0.3 through 26.0.0.7 range.
- Disable the adminCenter-1.0 feature on any instance where it is not required for operations.
- Restrict network access to the Liberty admin ports so that only trusted management networks can reach them.
- Apply the vendor-provided fix as documented on the IBM Support Page.
Patch Information
IBM has published remediation guidance for CVE-2026-11546 on the IBM Support Page. Administrators should upgrade to the fixed WebSphere Liberty version identified in that advisory. Verify the running version after patching by inspecting ${wlp.install.dir}/bin/productInfo version.
Workarounds
- Remove the <feature>adminCenter-1.0</feature> entry from server.xml on affected instances where the admin center is not in active use.
- Place the admin interface behind a reverse proxy that enforces authentication and blocks requests containing IP literals or non-HTTP URL schemes.
- Apply egress filtering at the host or network layer to prevent the Liberty JVM from initiating connections to internal management subnets and cloud metadata endpoints.
# Example: disable the adminCenter-1.0 feature in server.xml
# Edit ${WLP_USER_DIR}/servers/<serverName>/server.xml and remove:
# <feature>adminCenter-1.0</feature>
# Then restart the server
${WLP_INSTALL_DIR}/bin/server stop <serverName>
${WLP_INSTALL_DIR}/bin/server start <serverName>
# Verify installed version
${WLP_INSTALL_DIR}/bin/productInfo version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
