Advisory · CVE-2026-93895
Liberty gRPC access controls can be bypassed by an unauthenticated attacker
IBM WebSphere Application Server Liberty 20.0.0.12 through 26.0.0.10 can let an unauthenticated remote attacker bypass access controls configured on gRPC service methods. IBM rates it CVSS 3.1 9.1.
- Vendor
- IBM
- Product
- WebSphere Application Server Liberty
- Identifier / CWE
- CVE-2026-93895
CWE-284 - Action timing
- Immediate
Explain it like I’m five
The doorman checks credentials at the front entrance but the gRPC service door is unlocked, so strangers can call methods that were supposed to be protected.
- 01Connect to Liberty
An unauthenticated attacker reaches a Liberty server exposing gRPC services.
- 02Call a protected method
The attacker invokes a gRPC service method that has access controls configured.
- 03Control bypassed
Liberty allows the call despite the missing authentication.
- 04Service acts
The method runs with whatever data access it was built to have.
What happened
IBM disclosed CVE-2026-93895 for WebSphere Application Server Liberty releases 20.0.0.12 through 26.0.0.10. Per IBM, an unauthenticated remote attacker can bypass access controls configured on gRPC service methods (CWE-284).
No fixed version is named in the NVD record, so remediation follows the IBM bulletin and its interim fix guidance rather than a version guess here.
What to do
- Inventory every WebSphere Application Server Liberty deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to WebSphere Application Server Liberty while remediation is underway, especially for internet-facing instances.
- Review application and server logs for gRPC calls with no matching authenticated session, method invocations from unfamiliar clients, and access patterns outside normal service-to-service traffic.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
An access-control bypass on an application server’s service layer undermines every control built on top of it. Apply the IBM fix and audit gRPC exposure.