CVE-2026-14909: IBM WebSphere Liberty Information Disclosure

CVE-2026-14909 Overview

CVE-2026-14909 affects IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.9. The vulnerability allows an authenticated attacker to obtain sensitive information when the restConnector-2.0 feature is enabled. The issue stems from improper handling of error messages that expose sensitive data to actors who should not have access [CWE-209].

The flaw requires network access and low privileges but no user interaction. Exploitation impacts confidentiality but does not affect integrity or availability of the targeted system.

Critical Impact
Authenticated attackers can retrieve sensitive information from WebSphere Liberty servers running the restConnector-2.0 feature, potentially exposing credentials, configuration data, or internal application state.

Affected Products

IBM WebSphere Application Server Liberty 17.0.0.3
IBM WebSphere Application Server Liberty versions through 26.0.0.9
Deployments with the restConnector-2.0 feature enabled

Discovery Timeline

2026-10-13 - CVE CVE-2026-14909 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-14909

Vulnerability Analysis

The vulnerability is classified as Information Exposure Through an Error Message [CWE-209]. IBM WebSphere Application Server Liberty exposes sensitive information through the REST connector interface when restConnector-2.0 is enabled. An authenticated attacker with low privileges can query the REST connector endpoint and receive responses that leak server-side details not intended for the user's trust level.

The REST connector in Liberty exposes JMX (Java Management Extensions) MBeans over HTTPS, enabling remote management of the server. When error conditions occur during request processing, the server returns verbose output that may include stack traces, internal object state, or configuration data.

Attackers typically chain this disclosure with further reconnaissance to escalate access or pivot to adjacent systems. The required authentication reduces the attacker pool to users who already hold valid credentials for the management interface.

Root Cause

The root cause is overly detailed error messaging in the restConnector-2.0 feature. The server fails to sanitize responses before returning them to authenticated clients, allowing information intended for administrators or logs to reach lower-privileged users.

Attack Vector

Exploitation requires network access to the Liberty REST management endpoint and valid credentials. The attacker issues crafted REST requests that trigger error conditions and parses the responses for sensitive content. No user interaction or elevated privileges are required beyond standard REST connector authentication. Refer to the IBM Support Page for the vendor's technical description.

Detection Methods for CVE-2026-14909

Indicators of Compromise

Unusual volume of authenticated requests to the Liberty REST connector endpoint, typically /IBMJMXConnectorREST
HTTP 4xx or 5xx responses from the REST connector containing stack traces or configuration data in response bodies
Access by low-privilege management accounts to MBean paths they do not normally query

Detection Strategies

Review Liberty http_access.log and messages.log for repeated REST connector requests from a single authenticated principal.
Inspect outbound REST responses for exception class names, file paths, or credential-like strings that indicate information disclosure.
Correlate authentication events with REST connector errors to identify enumeration behavior.

Monitoring Recommendations

Forward WebSphere Liberty audit and access logs to a central SIEM for continuous analysis.
Alert on management account activity outside normal administrative windows.
Baseline normal REST connector usage patterns and flag deviations in request rate or endpoint diversity.

How to Mitigate CVE-2026-14909

Immediate Actions Required

Apply the IBM-provided fix referenced on the IBM Support Page as soon as feasible.
Audit which users and service accounts have access to the restConnector-2.0 endpoint and revoke unnecessary privileges.
Rotate credentials for any management accounts suspected of being compromised prior to patching.

Patch Information

IBM has published remediation guidance on the IBM Support Page. Administrators should upgrade to a fixed Liberty version or apply the recommended interim fix for the installed release.

Workarounds

Disable the restConnector-2.0 feature in server.xml if remote JMX management is not required.
Restrict network access to the Liberty REST connector endpoint using firewall rules or reverse-proxy allowlists.
Enforce strong authentication and role separation for management users to limit the blast radius of credential compromise.

bash

# Configuration example: disable restConnector-2.0 in server.xml
# Remove or comment out the following feature entry:
# <feature>restConnector-2.0</feature>