IBM CVE-2026-1561

The CVSS 3.1 score of 5.4 reflects a medium-severity vulnerability with important mitigating factors. The attack vector is network-accessible (AV:N) with low complexity (AC:L), meaning exploitation requires no special conditions, but the requirement for low privileges (PR:L) means an attacker must already be authenticated to trigger the flaw. The impact is limited to confidentiality and integrity (C:L, I:L) with no availability impact (A:N), suggesting the attacker can probe internal systems and potentially manipulate responses but cannot crash services. From a real-world risk perspective, this is a privilege-escalation or lateral-movement vector for authenticated users who may have legitimate access to Liberty but wish to pivot to internal resources. The presence of a vendor patch significantly reduces exploitation window risk. Without disclosed EPSS data or KEV status in the sources, the vulnerability should be treated as important but not critical—prioritize patching for externally-facing Liberty instances or those in multi-tenant environments, but standard monthly maintenance cycles are acceptable for isolated internal deployments.

An authenticated developer or application user with legitimate access to a Liberty-hosted web application could exploit this SSRF vulnerability to make the server perform HTTP requests to internal-only services—such as unprotected management endpoints, cloud metadata services, or other microservices on the internal network—that are normally inaccessible from the public internet. Since authentication is required (PR:L) and attack complexity is low (AC:L), the attacker needs only valid credentials and knowledge of the vulnerable parameter or endpoint. For example, a user might craft a request that causes Liberty to fetch internal AWS metadata or query an internal database admin panel, allowing them to enumerate the network topology or extract sensitive configuration data. The low impact scope (S:U) means the attacker gains capabilities within the security context of the Liberty process, but confidentiality and integrity leakage (C:L, I:L) could expose credentials, internal service details, or enable manipulation of backend responses.