CVE-2026-11714 Overview
CVE-2026-11714 is a Server-Side Request Forgery (SSRF) vulnerability affecting IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.7. The flaw exists when the apiDiscovery-1.0 feature is enabled on the Liberty runtime. An unauthenticated remote attacker can coerce the server into issuing arbitrary HTTP requests to internal or external systems. The vulnerability is tracked under CWE-918: Server-Side Request Forgery and has a CVSS 3.1 base score of 9.8.
Critical Impact
Unauthenticated attackers can abuse the apiDiscovery-1.0 feature to send crafted requests from the WebSphere Liberty server, potentially reaching internal services, cloud metadata endpoints, and other resources behind the network boundary.
Affected Products
- IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.7
- Deployments with the apiDiscovery-1.0 feature enabled
- Liberty runtimes exposing the API Discovery endpoints to untrusted networks
Discovery Timeline
- 2026-06-30 - CVE-2026-11714 published to NVD
- 2026-07-02 - Last updated in NVD database
Technical Details for CVE-2026-11714
Vulnerability Analysis
The apiDiscovery-1.0 feature in WebSphere Liberty exposes endpoints that document and interact with deployed APIs. The feature accepts request parameters that reference URLs the server subsequently fetches. Because these parameters are not sufficiently validated, an attacker can substitute arbitrary destinations. The Liberty server then performs outbound HTTP requests on behalf of the attacker.
This SSRF primitive allows attackers to reach systems reachable from the application server but not from the public internet. Common targets include cloud provider instance metadata services, internal administrative APIs, and databases bound to loopback interfaces. Successful exploitation can lead to credential theft, lateral movement, and disclosure of sensitive configuration data.
Root Cause
The root cause is insufficient validation of user-supplied URLs processed by the apiDiscovery-1.0 feature. The component trusts request-supplied endpoints without enforcing an allowlist, scheme restriction, or destination filter. This maps directly to CWE-918.
Attack Vector
Exploitation requires network access to the WebSphere Liberty instance and no authentication or user interaction. An attacker sends a crafted HTTP request to an apiDiscovery endpoint containing a target URL. The server then issues an outbound request to that URL and may return response content, headers, or error information to the attacker. Refer to the IBM Support advisory for vendor-specific details.
Detection Methods for CVE-2026-11714
Indicators of Compromise
- Unexpected outbound HTTP requests originating from the Liberty JVM process to internal RFC1918 addresses or cloud metadata endpoints such as 169.254.169.254.
- Access log entries targeting apiDiscovery paths (for example /ibm/api/docs, /ibm/api/explorer) from untrusted source IPs.
- Anomalous DNS lookups from the application server for domains not associated with legitimate application dependencies.
Detection Strategies
- Inspect Liberty http_access.log and messages.log for requests to API Discovery endpoints containing URL-shaped parameters.
- Correlate inbound requests to apiDiscovery endpoints with subsequent outbound connections from the same process to detect the SSRF pattern.
- Deploy web application firewall rules that flag URL parameters resolving to private address ranges or cloud metadata hosts.
Monitoring Recommendations
- Enable egress filtering on WebSphere Liberty hosts and alert on connections leaving the expected destination set.
- Monitor for cloud metadata service (IMDS) access from application servers and require IMDSv2 where applicable.
- Baseline outbound traffic from the Liberty process and alert on statistical deviations in destination diversity.
How to Mitigate CVE-2026-11714
Immediate Actions Required
- Apply the interim fix or upgrade referenced in the IBM Support advisory as soon as testing permits.
- Inventory all Liberty servers and identify those with the apiDiscovery-1.0 feature enabled in server.xml.
- Restrict network access to Liberty administrative and API discovery endpoints to trusted management networks only.
Patch Information
IBM has published guidance and fix availability on the IBM Support Page for CVE-2026-11714. Administrators should apply the vendor-supplied interim fix or upgrade to a Liberty version released after 26.0.0.7 that addresses the SSRF condition.
Workarounds
- Remove the apiDiscovery-1.0 feature from server.xml where API documentation is not required in production.
- Enforce egress firewall rules that block Liberty hosts from reaching internal management networks and cloud metadata endpoints.
- Place the Liberty instance behind a reverse proxy that strips or validates URL parameters targeting the apiDiscovery endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
