{"id":"CVE-2026-10743","kind":"vulnerability","aliases":["CVE-2026-10743"],"related":[],"title":"IBM MQ Operator: authenticated MQOPEN flaw crashes service or corrupts memory","description":"IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations.","summary":"IBM MQ (Operator and MQ Advanced container images) does not properly validate buffer sizes in MQOPEN operations. An authenticated network user can crash the queue manager or corrupt its memory. CVSS 8.8. No exploitation reported. IBM lists no workaround.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm mq operator","fixed":[],"affected":">= 2.0.0, <= 2.0.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":">= 3.2.0, <= 3.2.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.3.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.4","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.4","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.5","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.3.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":["4.0.5","4.1.0"],"affected":">= 3.3.0, <= 4.0.4","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-mq","kubernetes","messaging","openshift","vendor"],"not_affected_if":["no-network-exposure","unauthenticated-only-access"],"how_to_check":"List the operator version: kubectl get csv -A | grep -i ibm-mq (OpenShift) or helm list -A. Check the queue manager image: kubectl get qmgr -A -o yaml (spec.version and image). Exposed if the operator is 2.0.0-2.0.29, 3.2.0-3.2.29, 3.3.0-4.0.4, or the image is in the 9.3.0.x, 9.4.x (up to 9.4.0.26-r1 for SC2), or 10.0.0.0-r1 to 10.0.0.5-r1 ranges.","fix":"Upgrade: CD stream to Operator v4.1.0 with MQ Advanced image 10.0.1.0-r1; SC2 stream to Operator v4.0.5 with image 10.0.0.5-r2, or v3.2.30 with image 9.4.0.26-r2. LTS (Operator 2.0.x, images 9.3.x): bulletin lists no fix, so confirm with IBM. No workaround; restrict network access to MQ listeners and limit who can authenticate.","status":"open","published_at":"2026-10-19T17:17:02+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-23T22:33:06+00:00","updated_at":"2026-10-24T00:20:29+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-23T22:33:06Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade IBM MQ Operator to a fixed release; affected are 2.0.0 to 2.0.29, 3.2.0 to 3.2.29, and 3.3.0 to 3.6.2 (exact fixed versions unknown).","reach":"network","title":"IBM MQ Operator: authenticated MQOPEN flaw crashes service or corrupts memory","impact":"high","summary":"IBM MQ Operator has improper buffer size validation in MQOPEN operations. An authenticated user can cause a denial of service or corrupt memory.","category":"vendor","who_cares":["ibm-mq","kubernetes","messaging"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker crashes the queue manager or corrupts memory, possibly running code","analyst_note":"Find the fixed versions for each affected branch and the IBM security bulletin at https://nvd.nist.gov/vuln/detail/CVE-2026-10743 (sources list only NVD).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unauthenticated-only-access"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000534,"input_tokens":3207,"output_tokens":427,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed versions for each affected branch and the IBM security bulletin at https://nvd.nist.gov/vuln/detail/CVE-2026-10743 (sources list only NVD).","search":"'-10743':14A,17A '-2026':13A,16A '8.8':218B 'advanc':192B 'advanced':102A,108A,114A,120A,126A,132A,138A,144A,150A,156A,162A,168A,174A 'allow':229C 'attack':232C 'authent':4A,205B,231C 'buffer':199B,247C 'caus':234C 'contain':193B 'container':103A,109A,115A,121A,127A,133A,139A,145A,151A,157A,163A,169A,175A 'corrupt':10A,214B,240C 'could':228C 'crash':7A,209B 'cve':12A,15A 'cvss':217B 'denial':236C 'due':242C 'exploit':220B 'flaw':6A 'ibm':1A,18A,21A,24A,27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,99A,105A,111A,117A,123A,129A,135A,141A,147A,153A,159A,165A,171A,177A,181B,187B,222B,226C 'ibm-mq':180B 'imag':194B 'images':104A,110A,116A,122A,128A,134A,140A,146A,152A,158A,164A,170A,176A 'improp':244C 'kubernet':183B 'list':223B 'manag':212B 'memori':11A,216B,241C 'messag':184B 'mq':2A,19A,22A,25A,28A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A,101A,107A,113A,119A,125A,131A,137A,143A,149A,155A,161A,167A,173A,178A,182B,188B,191B,227C 'mqopen':5A,202B,250C 'network':206B 'openshift':185B 'oper':3A,189B,203B,251C 'operator':20A,23A,26A,29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A,179A 'proper':197B 'queue':211B 'report':221B 'servic':8A,238C 'size':200B,248C 'supplied':100A,106A,112A,118A,124A,130A,136A,142A,148A,154A,160A,166A,172A 'user':207B 'valid':198B,245C 'vendor':186B 'workaround':225B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-10743","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10743","severity":null,"published_at":"2026-10-19T17:17:02+00:00","modified_at":"2026-10-23T15:33:41+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-10743:640","url":null,"severity":null,"published_at":"2026-10-24T00:20:29+00:00","modified_at":"2026-10-24T00:20:29+00:00","first_seen_at":"2026-10-24T00:20:29+00:00","fetched_at":"2026-10-24T00:20:29+00:00","note":"Read IBM bulletin (primary, shared with CVE-2026-12665) and CVE record. Fixed: CD v4.1.0, SC2 v4.0.5 and v3.2.30. No LTS fix listed (v2.0.x). No workaround. No exploitation or PoC found in sources; social not searched. Bulletin has no per-CVE version ranges; affected list is bulletin-wide. CVE record CWE-1223 mismatches the description."}],"documents":[{"id":1957,"url":"https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-mq-operator-and-queue-manager-container-images-31","title":"IBM Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images (2026-10-15)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2556,"url":"https://www.cve.org/CVERecord?id=CVE-2026-10743","title":"CVE Record CVE-2026-10743 (CNA: IBM)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}