CVE-2026-11806: IBM WebSphere Information Disclosure Flaw

CVE-2026-11806 Overview

CVE-2026-11806 is an arbitrary file read vulnerability affecting IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.6. The flaw exists when the restConnector-2.0 feature is enabled on the server. A remote, unauthenticated attacker can exploit this vulnerability over the network to read arbitrary files accessible to the WebSphere process.

The vulnerability is classified under [CWE-444] (Inconsistent Interpretation of HTTP Requests). IBM has published a security advisory addressing the issue.

Critical Impact
Unauthenticated remote attackers can read sensitive files from affected WebSphere Liberty servers, potentially exposing configuration data, credentials, and application source code.

Affected Products

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.6
Deployments with the restConnector-2.0 feature enabled
Applications relying on Liberty JMX REST connector endpoints

Discovery Timeline

2026-06-30 - CVE-2026-11806 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-11806

Vulnerability Analysis

The vulnerability resides in the restConnector-2.0 feature of IBM WebSphere Application Server Liberty. This feature exposes JMX MBeans through a REST interface for remote server administration. When enabled, the connector inconsistently interprets HTTP requests, allowing an attacker to bypass access controls and retrieve arbitrary files from the underlying file system.

The issue affects confidentiality only. Integrity and availability of the server remain unaffected, but exposed files may include server.xml, keystores, application binaries, and other sensitive artifacts stored on the host. EPSS data indicates a 0.5% probability of exploitation within 30 days.

Root Cause

The root cause is inconsistent HTTP request interpretation [CWE-444] within the REST connector. The connector fails to properly normalize or validate request paths before resolving file references. This parsing inconsistency permits crafted requests to reference files outside the intended resource scope.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker sends a specially crafted HTTP request to the REST connector endpoint exposed by the Liberty server. The malformed request bypasses path validation, and the server returns the contents of the targeted file to the attacker.

Because the restConnector-2.0 endpoint is typically bound to administrative interfaces, environments that expose these endpoints to untrusted networks face the highest risk. See the IBM Support Documentation for the vendor's technical description.

Detection Methods for CVE-2026-11806

Indicators of Compromise

Unexpected HTTP requests to /IBMJMXConnectorREST endpoints from external or unusual source addresses
Access log entries referencing encoded path traversal sequences such as %2e%2e or ..%2f against the REST connector
Outbound transfers of large response payloads originating from the Liberty administrative port
Requests to the REST connector without valid administrative credentials returning HTTP 200 responses

Detection Strategies

Enable Liberty HTTP access logging and monitor requests targeting REST connector paths
Correlate authentication events with REST connector requests to identify unauthenticated access attempts
Deploy web application firewall rules that flag traversal patterns against WebSphere administrative endpoints
Review file system audit logs for unexpected read operations by the WebSphere process user

Monitoring Recommendations

Alert on any external network access to Liberty administrative ports, which are typically restricted to management networks
Baseline expected REST connector traffic and flag deviations in request volume or response size
Track patch status of Liberty deployments to identify unremediated systems running affected versions

How to Mitigate CVE-2026-11806

Immediate Actions Required

Apply the fix referenced in the IBM Support Documentation for WebSphere Application Server Liberty
Restrict network access to the REST connector port so only trusted administrative hosts can reach it
Audit all Liberty server.xml configurations to inventory servers that enable restConnector-2.0
Rotate credentials, keys, and certificates that may have been exposed through the file read primitive

Patch Information

IBM has released fixed builds addressing CVE-2026-11806. Consult the IBM Support Documentation for the specific interim fix and target fix pack version applicable to your deployment. Upgrade Liberty to a version later than 26.0.0.6 that includes the remediation.

Workarounds

Disable the restConnector-2.0 feature in server.xml where remote JMX administration is not required
Bind the REST connector to a loopback or dedicated management interface unreachable from untrusted networks
Enforce mutual TLS and strong administrative authentication on any remaining REST connector endpoints
Place the Liberty administrative port behind a reverse proxy that filters path traversal patterns

bash

# Configuration example: remove restConnector-2.0 from featureManager in server.xml
# Before:
#   <featureManager>
#     <feature>restConnector-2.0</feature>
#     <feature>servlet-4.0</feature>
#   </featureManager>
# After:
#   <featureManager>
#     <feature>servlet-4.0</feature>
#   </featureManager>

# Verify the feature is no longer active
grep -R "restConnector" ${WLP_USER_DIR}/servers/*/server.xml