CVE-2026-1561 - IBM WebSphere Application Server Liberty Server-Side Request Forgery

Back Back to CVE browser

MEDIUM

IBM WebSphere Application Server Liberty Server-Side Request Forgery

Published Mar 25, 2026

5.4

MEDIUM

CVSS 3.1

EPSS 0.29%

Description

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is vulnerable to server-side request forgery (SSRF). This may allow remote attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

Affected products

Vendor IBM Product WebSphere Application Server Liberty Default
n/a
- Version
  17.0.0.3
  Status
  affected
  Constraints
  <=26.0.0.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

IBM

WebSphere Application Server Liberty

n/a

Version	Status	Constraints
17.0.0.3	affected	<=26.0.0.3

Remediation

Vendor solution

Remediation/Fixes IBM strongly recommends addressing the vulnerability now by applying a currently available interim fix or fix pack that contains the fix for APAR PH70017 . To determine if a feature is enabled for IBM WebSphere Application Server Liberty, refer to How to determine if Liberty is using a specific feature . For IBM WebSphere Application Server Liberty 17.0.0.3 - 26.0.0.3 using the samlWeb-2.0 feature: · Upgrade to minimal fix pack levels as required by the interim fix and then apply the Interim Fix that resolves PH70017 --OR-- · Apply Liberty Fix Pack 26.0.0.4 or later (targeted availability 2Q2026). Additional interim fixes may be available and linked off the interim fix download page.

Weaknesses (1)

CWE-918

SSRF