Admins Must Patch IBM WebSphere Liberty to Fix Critical gRPC Auth Bypass
Unauthenticated attackers can bypass security on IBM WebSphere Liberty gRPC services. Administrators should verify exposure and plan updates immediately.
Key points
- IBM WebSphere Application Server Liberty versions 20.0.0.12 through 26.0.0.10 contain a critical vulnerability.
- The flaw allows remote attackers to bypass configured access controls on gRPC service methods without authentication.
- The National Vulnerability Database rates the issue as critical with a CVSS score of 9.1.
IBM WebSphere Application Server Liberty has a security flaw that lets attackers bypass access controls on gRPC services. This affects many versions of the software used by enterprises for running applications. The National Vulnerability Database assigns the identifier CVE-2026-93895 to this issue. The weakness is rated critical, indicating a severe risk to systems that are exposed to the internet or internal networks.
In plain English
Access controls are digital locks that determine who can use specific features of an application. In this case, the locks on gRPC services can be ignored by anyone. GPRC is a communication technology that allows different parts of a software system to talk to each other efficiently. When these services are exposed, an attacker does not need a password or permission to interact with them. This means unauthorized users could potentially perform actions they should not be able to execute.
The background
The vulnerability was recorded in the National Vulnerability Database with a CVSS score of 9.1. This score falls into the critical range, which typically indicates a high likelihood of exploitation and severe impact. The weakness is classified under CWE-284, which refers to improper access control. This category covers issues where a system fails to restrict access to a resource or function properly.
What changes now
Administrators managing IBM WebSphere Application Server Liberty must check their current versions. Any version from 20.0.0.12 up to and including 26.0.0.10 is affected. Systems running these versions are vulnerable to remote attacks that do not require authentication. Organizations should determine if their gRPC services are accessible from untrusted networks. If they are, the risk is immediate. There is no confirmed patch or fix available yet according to the source material.
Key terms explained
Teams usually review network configurations to limit exposure of service endpoints. Check whether gRPC services are reachable from external networks or only internal segments. Verify that access controls are enforced at the network level as well as the application level. Monitor logs for unusual traffic patterns that might indicate probing or unauthorized access attempts. Ensure that security teams have visibility into all service methods exposed by the application server.
What to do and how to stay safe: IBM WebSphere Liberty
- Verify the version of IBM WebSphere Application Server Liberty running on your systems.
- Determine if gRPC services are accessible from untrusted networks or the internet.
- Monitor server logs for unauthorized access attempts or unusual activity on service methods.
- Plan to apply updates once the vendor releases a confirmed fix for this vulnerability.
Step-by-step guide: Risk-Based Vulnerability Management: Benefits, Limits, and Reality
General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of IBM WebSphere Liberty are affected by CVE-2026-93895?
Versions 20.0.0.12 through 26.0.0.10 of IBM WebSphere Application Server Liberty are affected.
Is there a patch available for this vulnerability?
No, the source material does not mention a confirmed patch or fix for this issue.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates the vulnerability as critical with a CVSS score of 9.1.
