{"id":"CVE-2026-10572","kind":"vulnerability","aliases":["CVE-2026-10572"],"related":[],"title":"IBM MQ Operator: heap overflow on malformed MQPUT lets authenticated users run code","description":"IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options.","summary":"Heap buffer overflow in IBM MQ (queue manager) when processing MQPUT with malformed message options. An authenticated, network-reachable attacker with low privileges can cause DoS or potentially run code. CVSS 8.8 (IBM). Affects the MQ Operator and the IBM-supplied MQ Advanced container images. IBM lists no workarounds.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm mq operator","fixed":[],"affected":">= 2.0.0, <= 2.0.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":">= 3.2.0, <= 3.2.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.3.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.4","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.4","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.5","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.3.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":["4.0.5","4.1.0"],"affected":">= 3.3.0, <= 4.0.4","ecosystem":"vendor"},{"name":"ibm mq advanced container images","fixed":["10.0.1.0-r1","10.0.0.5-r2","9.4.0.26-r2"],"affected":"<= 10.0.0.5-r1 and 9.4.0.x through 9.4.0.26-r1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["container","ibm-mq","kubernetes","openshift","vendor"],"not_affected_if":["auth-required","version-outside-affected-ranges"],"how_to_check":"Get the operator version: oc get csv -n <operator-namespace> | grep ibm-mq (or kubectl get deployment -n <ns> and read the ibm-mq-operator image tag). Then check the queue manager image tag (oc get queuemanager <name> -o jsonpath='{.status.versions}' or the pod image). Affected: operator 2.0.0-2.0.29, 3.2.0-3.2.29, 3.3.0, 3.4.0-3.4.1, 3.5.0-3.5.3, 3.6.0-3.6.4, 3.7.0-3.7.2, 3.8.0-3.8.1, 3.9.0-3.9.2, 4.0.0-4.0.4, plus MQ Advanced images older than the fixed ones.","fix":"Upgrade operator and queue manager image together: 4.1.0 with MQ Advanced 10.0.1.0-r1 (CD); 4.0.5 with 10.0.0.5-r2 (SC2); 3.2.30 with 9.4.0.26-r2 (SC2). Standalone container images 10.0.1.0-r1 or 10.0.0.5-r2. LTS (operator 2.0.x, MQ 9.3 LTS): bulletin lists no fix, ask IBM. Until patched, restrict who can connect to channels and put messages.","status":"open","published_at":"2026-10-19T17:17:01+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-23T22:33:10+00:00","updated_at":"2026-10-24T00:21:48+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-23T22:33:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM MQ Operator: heap overflow on malformed MQPUT lets authenticated users run code","impact":"high","summary":"IBM MQ Operator has a heap buffer overflow triggered by MQPUT operations with malformed message options. An authenticated attacker can crash the queue manager or potentially execute arbitrary code.","category":"vendor","who_cares":["ibm-mq","kubernetes","openshift"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated attacker crashes queue manager or runs code on the server.","analyst_note":"Sources give no fixed version numbers ('fixed ?'); check the IBM security bulletin for CVE-2026-10572 for the patched release of each affected line.","how_to_check":"Check the installed IBM MQ Operator version (for example with oc get csv or kubectl get deployment in the operator namespace) and compare it with the affected ranges: 2.0.0 to 2.0.29, 3.2.0 to 3.2.29, and 3.3.0 to 3.6.2 listed exactly.","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000548,"input_tokens":3219,"output_tokens":453,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources give no fixed version numbers ('fixed ?'); check the IBM security bulletin for CVE-2026-10572 for the patched release of each affected line.","search":"'-10572':16A,19A '-2026':15A,18A '8.8':226B 'advanc':238B 'advanced':104A,110A,116A,122A,128A,134A,140A,146A,152A,158A,164A,170A,176A,184A 'affect':228B 'allow':248C 'arbitrari':261C 'attack':214B,251C 'authent':10A,210B,250C 'buffer':195B,267C 'caus':219B,253C 'code':13A,224B,262C 'contain':187B,239B 'container':105A,111A,117A,123A,129A,135A,141A,147A,153A,159A,165A,171A,177A,185A 'could':247C 'cve':14A,17A 'cvss':225B 'denial':255C 'dos':220B 'due':263C 'execut':260C 'heap':4A,194B,266C 'ibm':1A,20A,23A,26A,29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A,101A,107A,113A,119A,125A,131A,137A,143A,149A,155A,161A,167A,173A,179A,182A,189B,198B,227B,235B,241B,245C 'ibm-mq':188B 'ibm-suppli':234B 'imag':240B 'images':106A,112A,118A,124A,130A,136A,142A,148A,154A,160A,166A,172A,178A,186A 'kubernet':191B 'let':9A 'list':242B 'low':216B 'malform':7A,206B,274C 'manag':201B 'messag':207B,275C 'mq':2A,21A,24A,27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,99A,103A,109A,115A,121A,127A,133A,139A,145A,151A,157A,163A,169A,175A,180A,183A,190B,199B,230B,237B,246C 'mqput':8A,204B,271C 'network':212B 'network-reach':211B 'openshift':192B 'oper':3A,231B,272C 'operator':22A,25A,28A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A,100A,181A 'option':208B,276C 'overflow':5A,196B,268C 'potenti':222B,259C 'privileg':217B 'process':203B,270C 'queue':200B 'reachabl':213B 'run':12A,223B 'servic':257C 'suppli':236B 'supplied':102A,108A,114A,120A,126A,132A,138A,144A,150A,156A,162A,168A,174A 'user':11A 'vendor':193B 'workaround':244B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-10572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10572","severity":null,"published_at":"2026-10-19T17:17:01+00:00","modified_at":"2026-10-23T15:35:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-10572:642","url":null,"severity":null,"published_at":"2026-10-24T00:21:48+00:00","modified_at":"2026-10-24T00:21:48+00:00","first_seen_at":"2026-10-24T00:21:48+00:00","fetched_at":"2026-10-24T00:21:48+00:00","note":"Read IBM bulletin (2026-10-15): fixed in Operator 4.1.0 (CD), 4.0.5 (SC2), 3.2.30 (SC2); no fix listed for LTS 2.0.x; no workarounds. Affected range wider than triage (through 4.0.4). No exploitation or PoC found; social not searched (low-profile CVE). Does not list fixed images for LTS: confirm with IBM."}],"documents":[{"id":1957,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-mq-operator-and-queue-manager-container-images-31","title":"IBM Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images (2026-10-15)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2566,"url":"https://www.cve.org/CVERecord?id=CVE-2026-10572","title":"CVE Record: CVE-2026-10572 (CNA: IBM)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}