IBM WAS Liberty 1726 Authenticated Info Disclosure via restConnector2.0
CVE-2026-14909 Published on October 13, 2026

IBM WebSphere Application Server Liberty Information Disclosure
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to obtain sensitive information when restConnector-2.0 is enbabled.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-14909 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

Generation of Error Message Containing Sensitive Information

The software generates an error message that includes sensitive information about its environment, users, or associated data.


Products Associated with CVE-2026-14909

Want to know whenever a new CVE is published for IBM Websphere Application Server Liberty? stack.watch will email you.

IBM Websphere Application Server Liberty
 

Affected Versions

IBM WebSphere Application Server - Liberty: