Live › vulnerability › CVE-2026-12148
Go to dashboardIBM MQ Operator deserializes untrusted Java objects in its MQ Classes for Java component without restriction. An authenticated attacker can cause a denial of service or potentially execute arbitrary code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ibm mq operator | vendor | >= 2.0.0, <= 2.0.29 | – |
| ibm mq operator | vendor | >= 3.2.0, <= 3.2.29 | – |
| ibm mq operator | vendor | = 3.3.0 | – |
| ibm mq operator | vendor | = 3.4.0 | – |
| ibm mq operator | vendor | = 3.4.1 | – |
| ibm mq operator | vendor | = 3.5.0 | – |
| ibm mq operator | vendor | = 3.5.1 | – |
| ibm mq operator | vendor | = 3.5.2 | – |
| ibm mq operator | vendor | = 3.5.3 | – |
| ibm mq operator | vendor | = 3.6.0 | – |
| ibm mq operator | vendor | = 3.6.1 | – |
| ibm mq operator | vendor | = 3.6.2 | – |
| ibm mq operator | vendor | = 3.6.3 | – |
| ibm mq operator | vendor | = 3.6.4 | – |
| ibm mq operator | vendor | = 3.7.0 | – |
| ibm mq operator | vendor | = 3.7.1 | – |
| ibm mq operator | vendor | = 3.7.2 | – |
| ibm mq operator | vendor | = 3.8.0 | – |
| ibm mq operator | vendor | = 3.8.1 | – |
| ibm mq operator | vendor | = 3.9.0 | – |
| ibm mq operator | vendor | = 3.9.1 | – |
| ibm mq operator | vendor | = 3.9.2 | – |
| ibm mq operator | vendor | = 4.0.0 | – |
| ibm mq operator | vendor | = 4.0.1 | – |
| ibm mq operator | vendor | = 4.0.2 | – |
| ibm mq operator | vendor | = 4.0.3 | – |
| ibm mq operator | vendor | = 4.0.4 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.1.0 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.1.1 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.2.0 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.2.1 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.3.0 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.3.1 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.4.0 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.4.1 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.5.0 | – |
| ibm supplied mq advanced container images | vendor | = 9.4.5.1 | – |
| ibm supplied mq advanced container images | vendor | = 10.0.0.0 | – |
| ibm supplied mq advanced container images | vendor | = 10.0.0.5 | – |
| ibm supplied mq advanced container images | vendor | = 9.3.0.0 | – |
Check the installed MQ Operator version (for example with oc get csv or helm list depending on how it was installed) and compare it against the affected ranges: 2.0.0 to 2.0.29, 3.2.0 to 3.2.29, and exactly 3.3.0 through 3.6.2 listed individually.
Upgrade the IBM MQ Operator to a fixed release listed in the IBM security bulletin for CVE-2026-12148; the fixed version numbers are unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java.
This page as .md · .json · in your agent: get_signal("CVE-2026-12148")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.