EUVD-2026-51139
GHSA-78m2-w26r-hcp9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SSRF extends impact beyond Liberty to internal systems, warranting S:C; all other metrics align with network CSRF requiring no attacker privileges but mandatory victim interaction.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when the collectiveController-1.0 feature is enabled.
AnalysisAI
Cross-site request forgery in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 enables server-side request forgery with elevated privileges when the collectiveController-1.0 feature is active. An attacker who lures an authenticated Liberty administrator to a malicious web page can trigger forged requests that the server executes with the victim's elevated privileges, allowing the attacker to reach internal services ordinarily inaccessible from the network perimeter. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The collectiveController-1.0 Liberty feature must be explicitly enabled in server.xml - this is not a default configuration, so Liberty deployments not using collective management are not exposed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Despite a CVSS 3.1 score of 8.8 (High) with AV:N/AC:L/PR:N/UI:R, the real-world exploitation probability is low. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies an organisation running Liberty with collectiveController-1.0 enabled, then crafts a malicious HTML page containing a hidden form or image tag targeting the collective controller REST API. The attacker sends a phishing email to a known Liberty administrator; when the administrator visits the page while holding an active session, the browser silently submits the forged request, and the Liberty server processes it with the administrator's elevated privileges - allowing the attacker to direct the server to make arbitrary HTTP requests to internal hosts such as metadata services, internal APIs, or other cluster members unreachable from the internet. … |
| Remediation | IBM has released a patch addressing this vulnerability; upgrade to the fixed version documented in the IBM support page at https://www.ibm.com/support/pages/node/7281651 (exact fix version not independently specified in available data beyond the advisory reference). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WebSphere Liberty instances running versions 17.0.0.3 through 26.0.0.8 with collectiveController-1.0 feature enabled by reviewing deployment inventory and server configurations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unsafe class loading in the ORB (Object Request Broker) component of IBM WebSphere Application Server 8.5, 9.0, and Libe
HTTP request smuggling in IBM WebSphere Application Server (traditional 8.5 and 9.0) and WebSphere Liberty (17.0.0.3 thr
Server-side request forgery in IBM WebSphere Application Server (traditional 9.0 and 8.5) and WebSphere Application Serv
Remote code execution in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8) allows unauthenti
IBM WebSphere Application Server Liberty 23.0.0.9 through 23.0.0.10 could provide weaker than expected security due to i
Authentication bypass in IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8) allows remote att
HTTP request smuggling in IBM WebSphere Application Server 8.5/9.0 and WebSphere Application Server Liberty 17.0.0.3 thr
HTTP response smuggling in IBM WebSphere Application Server 9.0, 8.5, and Liberty versions 17.0.0.3 through 26.0.0.7 all
HTTP request smuggling in IBM WebSphere Application Server 8.5, 9.0, and Liberty 17.0.0.3 through 26.0.0.7 allows remote
Privilege escalation in IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 allows an authenticated low
HTTP request smuggling in IBM WebSphere Application Server (versions 8.5 and 9.0) and WebSphere Application Server Liber
Information disclosure in IBM WebSphere Liberty ND Collective Controller, versions 17.0.0.3 through 26.0.0.8, allows rem
Same weakness CWE-269 – Improper Privilege Management
View allShare
External POC / Exploit Code
Leaving vuln.today