{"id":"CVE-2026-11829","kind":"vulnerability","aliases":["CVE-2026-11829"],"related":[],"title":"IBM MQ Operator: authenticated MQOPEN offset flaw enables denial of service","description":"IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests.","summary":"IBM MQ Operator mishandles offset values in MQOPEN requests, so an authenticated client can crash or stall the queue manager. The sources describe denial of service only, not code execution or data access.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm mq operator","fixed":[],"affected":">= 2.0.0, <= 2.0.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":">= 3.2.0, <= 3.2.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.3.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.4","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.4","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.5","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-mq","kubernetes","messaging","openshift","vendor"],"not_affected_if":["auth-required","not-using-mq-operator"],"how_to_check":"- Check the installed IBM MQ Operator version in the cluster, for example with `oc get csv` or `kubectl get csv -A`, and compare it with the affected ranges.\n- Confirm whether the MQ Operator is deployed in the cluster at all, and which queue managers it runs.","fix":"- Upgrade IBM MQ Operator 2.x to a release later than `2.0.29`, and 3.2.x to a release later than `3.2.29`.\n- Upgrade IBM MQ Operator 3.3.0 through 3.6.2 to the fixed release named in IBM's bulletin; the fixed version is unknown from these sources.","status":"open","published_at":"2026-10-19T17:17:16+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:55:51+00:00","updated_at":"2026-10-25T03:55:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:55:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade IBM MQ Operator 2.x to a release later than `2.0.29`, and 3.2.x to a release later than `3.2.29`.\n- Upgrade IBM MQ Operator 3.3.0 through 3.6.2 to the fixed release named in IBM's bulletin; the fixed version is unknown from these sources.","reach":"network","title":"IBM MQ Operator: authenticated MQOPEN offset flaw enables denial of service","impact":"low","summary":"IBM MQ Operator mishandles offset values in MQOPEN requests, so an authenticated client can crash or stall the queue manager. The sources describe denial of service only, not code execution or data access.","category":"vendor","nicknames":[],"who_cares":["ibm-mq","kubernetes","openshift","messaging"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated attacker crashes the queue manager, causing denial of service","analyst_note":"Find the IBM security bulletin and the fixed version for the 3.3.0 to 3.6.2 range; the NVD entry does not give it.","how_to_check":"- Check the installed IBM MQ Operator version in the cluster, for example with `oc get csv` or `kubectl get csv -A`, and compare it with the affected ranges.\n- Confirm whether the MQ Operator is deployed in the cluster at all, and which queue managers it runs.","needs_analyst":true,"not_affected_if":["not-using-mq-operator","auth-required"],"who_is_affected":"Teams running the IBM MQ Operator in the affected version ranges, which are 2.0.0 to 2.0.29, 3.2.0 to 3.2.29, and 3.3.0 to 3.6.2. The attacker must hold valid credentials to reach the MQOPEN path, so exposure depends on who can authenticate to queue managers. Teams not running the operator can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000709,"input_tokens":3602,"output_tokens":697,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-11829':14A,17A '-2026':13A,16A 'access':216B 'advanced':102A,108A,114A,120A,126A,132A,138A,144A,150A,156A,162A,168A,174A 'allow':220C 'attack':223C 'authent':4A,195B,222C 'caus':225C 'client':196B 'code':212B 'container':103A,109A,115A,121A,127A,133A,139A,145A,151A,157A,163A,169A,175A 'could':219C 'crash':198B 'cve':12A,15A 'data':215B 'denial':9A,207B,227C 'describ':206B 'due':230C 'enabl':8A 'execut':213B 'flaw':7A 'ibm':1A,18A,21A,24A,27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,99A,105A,111A,117A,123A,129A,135A,141A,147A,153A,159A,165A,171A,178B,184B,217C 'ibm-mq':177B 'images':104A,110A,116A,122A,128A,134A,140A,146A,152A,158A,164A,170A,176A 'improp':232C 'kubernet':180B 'manag':203B 'messag':181B 'mishandl':187B 'mq':2A,19A,22A,25A,28A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A,101A,107A,113A,119A,125A,131A,137A,143A,149A,155A,161A,167A,173A,179B,185B,218C 'mqopen':5A,191B,238C 'offset':6A,188B,235C 'openshift':182B 'oper':3A,186B 'operator':20A,23A,26A,29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A 'queue':202B 'request':192B,239C 'servic':11A,209B,229C 'sourc':205B 'stall':200B 'supplied':100A,106A,112A,118A,124A,130A,136A,142A,148A,154A,160A,166A,172A 'valid':233C 'valu':189B,236C 'vendor':183B","nicknames":[],"mitigations":[],"who_affected":"Teams running the IBM MQ Operator in the affected version ranges, which are 2.0.0 to 2.0.29, 3.2.0 to 3.2.29, and 3.3.0 to 3.6.2. The attacker must hold valid credentials to reach the MQOPEN path, so exposure depends on who can authenticate to queue managers. Teams not running the operator can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-11829","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11829","severity":null,"published_at":"2026-10-19T17:17:16+00:00","modified_at":"2026-10-23T20:59:34+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}