CVE-2026-93895 Overview
CVE-2026-93895 is an access control vulnerability in IBM WebSphere Application Server Liberty versions 20.0.0.12 through 26.0.0.10. The flaw allows an unauthenticated remote attacker to bypass access controls configured on gRPC service methods. The weakness is classified as Improper Access Control [CWE-284] and affects deployments that rely on Liberty's gRPC feature for exposing service endpoints.
Exploitation requires only network access to a vulnerable gRPC endpoint. Because authentication is not needed, any internet-exposed Liberty instance running gRPC services with method-level access controls is at risk of unauthorized method invocation.
Critical Impact
Unauthenticated remote attackers can invoke gRPC service methods that administrators believed were protected by configured access controls, leading to unauthorized data access and modification.
Affected Products
- IBM WebSphere Application Server Liberty 20.0.0.12
- IBM WebSphere Application Server Liberty versions between 20.0.0.12 and 26.0.0.10
- IBM WebSphere Application Server Liberty 26.0.0.10
Discovery Timeline
- 2026-10-13 - CVE CVE-2026-93895 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-93895
Vulnerability Analysis
The vulnerability resides in how IBM WebSphere Application Server Liberty enforces access control decisions for gRPC service methods. Administrators can configure authorization constraints that restrict which callers may invoke specific gRPC methods. The runtime fails to consistently apply these constraints before dispatching the method call.
An attacker who can reach the gRPC endpoint over the network can invoke protected methods without presenting valid credentials. The impact scope covers both confidentiality and integrity, because gRPC methods frequently expose data retrieval and state-changing operations. Availability is not directly affected according to the published vector.
Root Cause
The root cause is improper access control [CWE-284] in the gRPC request-handling pipeline. Authorization checks that should gate method dispatch are either skipped or evaluated against incomplete request context. The result is that configured policies do not translate into runtime enforcement for gRPC method invocations.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker crafts a gRPC request targeting a protected service method on a reachable Liberty endpoint. The server processes the request and returns the method response without first validating that the caller satisfies the configured access control policy.
See the IBM Support Page for the authoritative technical write-up and fix details. No public proof-of-concept exploit is currently referenced in NVD.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-93895
Indicators of Compromise
- Successful gRPC method invocations in Liberty access logs from client identities that do not match any authenticated user or expected service principal.
- gRPC responses returning sensitive data to callers that lack an authenticated session recorded in Liberty security audit logs.
- Spikes in gRPC traffic volume targeting methods that are normally invoked by a small number of internal services.
Detection Strategies
- Correlate Liberty HTTP/2 access logs with security audit logs to identify gRPC calls that completed without a corresponding authentication or authorization event.
- Baseline normal gRPC method callers per service and alert on invocations originating from unexpected source IPs or user agents.
- Review application-level logs for business operations triggered by requests that lack an associated authenticated principal.
Monitoring Recommendations
- Enable Liberty audit logging with the audit-1.0 feature and forward events to a centralized SIEM for correlation.
- Monitor outbound data volume from gRPC endpoints to detect bulk extraction through protected methods.
- Track the deployed Liberty version across the estate and flag any instance in the 20.0.0.12 through 26.0.0.10 range.
How to Mitigate CVE-2026-93895
Immediate Actions Required
- Inventory all IBM WebSphere Application Server Liberty instances and identify those running versions 20.0.0.12 through 26.0.0.10 with the gRPC feature enabled.
- Apply the fix referenced on the IBM Support Page as soon as it can be scheduled.
- Restrict network reachability of Liberty gRPC endpoints to trusted client ranges until the patch is applied.
Patch Information
IBM has published remediation guidance on the IBM Support Page. Administrators should upgrade to the fixed Liberty release identified in that advisory and validate that gRPC authorization policies are enforced after the upgrade.
Workarounds
- Disable the gRPC feature in server.xml on affected Liberty instances where gRPC is not strictly required.
- Front Liberty gRPC endpoints with a reverse proxy or API gateway that performs independent authentication and authorization before forwarding traffic.
- Apply network segmentation and firewall rules to limit gRPC endpoint exposure to a defined list of client systems.
# Example: disable the gRPC feature in Liberty server.xml as a temporary workaround
# Remove or comment out the following feature entries, then restart the server
# <featureManager>
# <feature>grpc-1.0</feature>
# <feature>grpcClient-1.0</feature>
# </featureManager>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
