--- id: "CVE-2026-10743" kind: "vulnerability" aliases: ["CVE-2026-10743"] title: "IBM MQ Operator: authenticated MQOPEN flaw crashes service or corrupts memory" severity: "high" cvss: 8.8 epss: null exploited: false status: "open" category: "vendor" products: [{"name": "ibm mq operator", "fixed": [], "affected": ">= 2.0.0, <= 2.0.29", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": ">= 3.2.0, <= 3.2.29", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.3.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.4.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.4.1", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.5.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.5.1", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.5.2", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.5.3", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.6.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.6.1", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.6.2", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.6.3", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.6.4", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.7.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.7.1", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.7.2", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.8.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.8.1", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.9.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.9.1", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.9.2", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 4.0.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 4.0.1", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 4.0.2", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 4.0.3", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 4.0.4", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.1.0", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.1.1", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.2.0", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.2.1", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.3.0", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.3.1", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.4.0", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.4.1", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.5.0", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.5.1", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 10.0.0.0", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 10.0.0.5", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.3.0.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": ["4.0.5", "4.1.0"], "affected": ">= 3.3.0, <= 4.0.4", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["ibm-mq", "kubernetes", "messaging", "openshift", "vendor"] not_affected_if: ["no-network-exposure", "unauthenticated-only-access"] published_at: "2026-10-19T17:17:02+00:00" first_seen_at: "2026-10-23T21:57:18+00:00" updated_at: "2026-10-24T00:20:29+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10743", "first_seen_at": "2026-10-23T21:57:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:20:29+00:00"}] --- # IBM MQ Operator: authenticated MQOPEN flaw crashes service or corrupts memory IBM MQ (Operator and MQ Advanced container images) does not properly validate buffer sizes in MQOPEN operations. An authenticated network user can crash the queue manager or corrupt its memory. CVSS 8.8. No exploitation reported. IBM lists no workaround. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:ibm mq operator affected >= 2.0.0, <= 2.0.29 fixed ? - vendor:ibm mq operator affected >= 3.2.0, <= 3.2.29 fixed ? - vendor:ibm mq operator affected = 3.3.0 fixed ? - vendor:ibm mq operator affected = 3.4.0 fixed ? - vendor:ibm mq operator affected = 3.4.1 fixed ? - vendor:ibm mq operator affected = 3.5.0 fixed ? - vendor:ibm mq operator affected = 3.5.1 fixed ? - vendor:ibm mq operator affected = 3.5.2 fixed ? - vendor:ibm mq operator affected = 3.5.3 fixed ? - vendor:ibm mq operator affected = 3.6.0 fixed ? - vendor:ibm mq operator affected = 3.6.1 fixed ? - vendor:ibm mq operator affected = 3.6.2 fixed ? - vendor:ibm mq operator affected = 3.6.3 fixed ? - vendor:ibm mq operator affected = 3.6.4 fixed ? - vendor:ibm mq operator affected = 3.7.0 fixed ? - vendor:ibm mq operator affected = 3.7.1 fixed ? - vendor:ibm mq operator affected = 3.7.2 fixed ? - vendor:ibm mq operator affected = 3.8.0 fixed ? - vendor:ibm mq operator affected = 3.8.1 fixed ? - vendor:ibm mq operator affected = 3.9.0 fixed ? - vendor:ibm mq operator affected = 3.9.1 fixed ? - vendor:ibm mq operator affected = 3.9.2 fixed ? - vendor:ibm mq operator affected = 4.0.0 fixed ? - vendor:ibm mq operator affected = 4.0.1 fixed ? - vendor:ibm mq operator affected = 4.0.2 fixed ? - vendor:ibm mq operator affected = 4.0.3 fixed ? - vendor:ibm mq operator affected = 4.0.4 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.1.0 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.1.1 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.2.0 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.2.1 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.3.0 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.3.1 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.4.0 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.4.1 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.5.0 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.5.1 fixed ? - vendor:ibm supplied mq advanced container images affected = 10.0.0.0 fixed ? - vendor:ibm supplied mq advanced container images affected = 10.0.0.5 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.3.0.0 fixed ? - vendor:ibm mq operator affected >= 3.3.0, <= 4.0.4 fixed 4.0.5, 4.1.0 ## How to check List the operator version: kubectl get csv -A | grep -i ibm-mq (OpenShift) or helm list -A. Check the queue manager image: kubectl get qmgr -A -o yaml (spec.version and image). Exposed if the operator is 2.0.0-2.0.29, 3.2.0-3.2.29, 3.3.0-4.0.4, or the image is in the 9.3.0.x, 9.4.x (up to 9.4.0.26-r1 for SC2), or 10.0.0.0-r1 to 10.0.0.5-r1 ranges. ## Fix Upgrade: CD stream to Operator v4.1.0 with MQ Advanced image 10.0.1.0-r1; SC2 stream to Operator v4.0.5 with image 10.0.0.5-r2, or v3.2.30 with image 9.4.0.26-r2. LTS (Operator 2.0.x, images 9.3.x): bulletin lists no fix, so confirm with IBM. No workaround; restrict network access to MQ listeners and limit who can authenticate. ## Timeline - 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-10743 - 2026-10-24T00:20:29+00:00 analyst — Read IBM bulletin (primary, shared with CVE-2026-12665) and CVE record. Fixed: CD v4.1.0, SC2 v4.0.5 and v3.2.30. No LTS fix listed (v2.0.x). No workaround. No exploitation or PoC found in sources; social not searched. Bulletin has no per-CVE version ranges; affected list is bulletin-wide. CVE record CWE-1223 mismatches the description. ## Documents - [advisory] IBM Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images (2026-10-15) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-mq-operator-and-queue-manager-container-images-31 - [describes] CVE Record CVE-2026-10743 (CNA: IBM) https://www.cve.org/CVERecord?id=CVE-2026-10743 ## From the sources IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_