{"id":"CVE-2026-11547","kind":"vulnerability","aliases":["CVE-2026-11547"],"related":[],"title":"IBM WebSphere Liberty: server-side request forgery in Admin Center deploy endpoint","description":"IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by a server-side request forgery vulnerability in the Admin Center deploy validation endpoint.","summary":"IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 contain a server-side request forgery flaw in the Admin Center deploy validation endpoint. An attacker can make the server send requests to destinations of their choosing, such as internal services.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm","infrastructure","java","self-hosted","websphere-liberty"],"not_affected_if":["admin-center-disabled","version-outside-range"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-08T17:16:37+00:00","first_seen_at":"2026-11-08T17:22:01+00:00","triaged_at":"2026-11-08T17:24:20+00:00","updated_at":"2026-11-08T17:24:20+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-08T17:24:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"IBM WebSphere Liberty: server-side request forgery in Admin Center deploy endpoint","impact":"medium","summary":"IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 contain a server-side request forgery flaw in the Admin Center deploy validation endpoint. An attacker can make the server send requests to destinations of their choosing, such as internal services.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["websphere-liberty","ibm","java","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Server sends requests to internal targets chosen by an attacker","analyst_note":"Find the IBM security bulletin for CVE-2026-11547 to confirm the fixed version, the authentication requirement, and whether Admin Center must be enabled.","how_to_check":"- Check the Liberty version with `productInfo version` in the Liberty install directory, or look at the version in the server's startup log.\n- Check whether the Admin Center feature (`adminCenter-1.0`) is enabled in `server.xml`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range","admin-center-disabled"],"who_is_affected":"Teams running IBM WebSphere Application Server Liberty in the affected range that use the Admin Center deploy validation endpoint. Servers without Admin Center enabled, or on versions outside the listed range, are likely not exposed. The sources do not say what the fixed version is.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000752,"input_tokens":4533,"output_tokens":598,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-11547':16A,19A '-2026':15A,18A '17.0.0.3':35B,75C '26.0.0.10':37B,77C 'admin':10A,48B,90C 'affect':79C 'applic':31B,72C 'attack':54B 'center':11A,49B,91C 'choos':65B 'contain':38B 'cve':14A,17A 'deploy':12A,50B,92C 'destin':62B 'endpoint':13A,52B,94C 'flaw':45B 'forgeri':8A,44B,86C 'host':25B 'ibm':1A,20B,29B,70C 'infrastructur':21B 'intern':68B 'java':22B 'liberti':3A,28B,33B,74C 'make':56B 'request':7A,43B,60B,85C 'self':24B 'self-host':23B 'send':59B 'server':5A,32B,41B,58B,73C,83C 'server-sid':4A,40B,82C 'servic':69B 'side':6A,42B,84C 'valid':51B,93C 'version':34B 'vulner':87C 'webspher':2A,27B,30B,71C 'websphere-liberti':26B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM WebSphere Application Server Liberty in the affected range that use the Admin Center deploy validation endpoint. Servers without Admin Center enabled, or on versions outside the listed range, are likely not exposed. The sources do not say what the fixed version is.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibm","infrastructure","java","medium","selfhosted","websphereliberty"],"campaign_type":null,"search_a":"'-11547':16A,19A '-2026':15A,18A 'admin':10A 'center':11A 'cve':14A,17A 'deploy':12A 'endpoint':13A 'forgeri':8A 'ibm':1A 'liberti':3A 'request':7A 'server':5A 'server-sid':4A 'side':6A 'webspher':2A","search_b":"'17.0.0.3':35B '26.0.0.10':37B 'admin':48B 'applic':31B 'attack':54B 'center':49B 'choos':65B 'contain':38B 'deploy':50B 'destin':62B 'endpoint':52B 'flaw':45B 'forgeri':44B 'host':25B 'ibm':20B,29B 'infrastructur':21B 'intern':68B 'java':22B 'liberti':28B,33B 'make':56B 'request':43B,60B 'self':24B 'self-host':23B 'send':59B 'server':32B,41B,58B 'server-sid':40B 'servic':69B 'side':42B 'valid':51B 'version':34B 'webspher':27B,30B 'websphere-liberti':26B","search_c":"'17.0.0.3':75C '26.0.0.10':77C 'admin':90C 'affect':79C 'applic':72C 'center':91C 'deploy':92C 'endpoint':94C 'forgeri':86C 'ibm':70C 'liberti':74C 'request':85C 'server':73C,83C 'server-sid':82C 'side':84C 'valid':93C 'vulner':87C 'webspher':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T17:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-11547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11547","severity":null,"published_at":"2026-11-08T17:16:37+00:00","modified_at":"2026-11-08T17:16:37+00:00","first_seen_at":"2026-11-08T17:22:01+00:00","fetched_at":"2026-11-08T17:22:01+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}