Plenty of internal Java apps run on IBM WebSphere Liberty, and some of them expose gRPC services to other systems. IBM says that, with the gRPC feature switched on, an attacker with no login can call service methods that were supposed to be protected.
IBM rates it 9.1 and lists no workaround. The fix is an interim fix now, or a fix pack due later this quarter.
If your Liberty server has gRPC turned on, the access rules on those methods may not be doing anything.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
IBM fixes a gRPC login bypass in WebSphere Liberty
IBM’s October 13 security bulletin covers three Liberty bugs that apply when the grpc-1.0 feature is enabled. The serious one, CVE-2026-93895, lets an unauthenticated remote attacker bypass access controls configured on gRPC service methods. IBM scores it 9.1.
The same bulletin fixes CVE-2026-95695, an incorrect authorization flaw rated 7.4, and CVE-2026-95696, a denial of service rated 6.5. Liberty 20.0.0.12 through 26.0.0.10 is affected.
Only Liberty servers with the grpc-1.0 feature are affected
gRPC endpoints are often internal APIs between services, and teams protect individual methods with role rules instead of putting a gateway in front. With this bug, those rules can be skipped, so whatever a protected method does, such as reading records or changing data, is open to anyone who can reach the port.
IBM has not reported exploitation. Liberty without grpc-1.0 is not affected, which makes the first check quick.
Check for grpc-1.0, then apply the interim fix
- Check each Liberty server’s
server.xmlfeature list, or the startup log, forgrpc-1.0. - On servers that have it, move to the minimum fix pack the interim fix requires and apply the interim fix for APAR DT502929.
- Plan the move to Liberty fix pack 26.0.0.11, which IBM targets for the fourth quarter of 2026.
- Until the fix is in, keep gRPC ports reachable only from the services that call them.
Forward this
For our Java and middleware team: IBM says WebSphere Liberty servers with the grpc-1.0 feature let someone call protected gRPC methods without logging in. Can we check which Liberty servers have gRPC enabled and apply IBM’s interim fix for APAR DT502929 on those?
Details
- CVE-2026-93895: improper access control on gRPC service methods (CWE-284), CVSS 3.1 score 9.1, no authentication.
- CVE-2026-95695: incorrect authorization (CWE-863), 7.4. CVE-2026-95696: denial of service (CWE-400), 6.5.
- Affected: WebSphere Application Server Liberty 20.0.0.12 to 26.0.0.10 with
grpc-1.0. Fix: interim fix for APAR DT502929, or fix pack 26.0.0.11. No workaround.
Hunt / verify
- gRPC calls to protected methods from clients that never authenticated, in Liberty access logs or your service mesh telemetry.
- Unexpected sources reaching Liberty gRPC ports from outside the calling services.
Source: IBM security bulletin, WebSphere Liberty; CVE.org: CVE-2026-93895
Sources
- IBM: Security Bulletin, WebSphere Application Server Liberty is affected by multiple vulnerabilities (CVE-2026-93895, CVE-2026-95695, CVE-2026-95696)
- CVE.org: CVE-2026-93895
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
