---
id: "CVE-2026-78636"
page: "https://infrastack.ai/live/CVE-2026-78636"
kind: "vulnerability"
aliases: ["CVE-2026-78636"]
title: "IBM WebSphere Liberty: JMX REST connector leaks information through unsafe reflection"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["java", "jmx", "liberty", "runtime", "websphere"]
not_affected_if: ["jmx-rest-disabled"]
published_at: "2026-11-08T19:17:40+00:00"
first_seen_at: "2026-11-08T19:22:34+00:00"
updated_at: "2026-11-08T19:23:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-78636", "first_seen_at": "2026-11-08T19:22:34+00:00"}]
exploit_sources: []
---

# IBM WebSphere Liberty: JMX REST connector leaks information through unsafe reflection

Link for people: https://infrastack.ai/live/CVE-2026-78636 (this .md is for agents)

IBM WebSphere Application Server Liberty versions 17.0.0.3 through 26.0.0.10 expose information because the JMX REST connector body parser uses unsafe class reflection. An attacker who can reach the connector can read data the server should keep hidden.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-08T19:22:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-78636

## From the sources

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by an information disclosure vulnerability due to unsafe class reflection in the JMX REST connector body parser.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_