{"id":"CVE-2026-12148","kind":"vulnerability","aliases":["CVE-2026-12148"],"related":[],"title":"IBM MQ Operator: authenticated user can crash it or run code","description":"IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java.","summary":"IBM MQ Operator deserializes untrusted Java objects in its MQ Classes for Java component without restriction. An authenticated attacker can cause a denial of service or potentially execute arbitrary code.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm mq operator","fixed":[],"affected":">= 2.0.0, <= 2.0.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":">= 3.2.0, <= 3.2.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.3.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.4","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.4","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.5","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-mq","java","kubernetes","openshift","vendor"],"not_affected_if":["no-mq-operator-installed","version-outside-listed-ranges"],"how_to_check":"Check the installed MQ Operator version (for example with oc get csv or helm list, depending on how it was installed) and compare it against the affected ranges: 2.0.0 to 2.0.29, 3.2.0 to 3.2.29, and exactly 3.3.0 through 3.6.2 listed individually.","fix":"Upgrade the IBM MQ Operator to a fixed release listed in the IBM security bulletin for CVE-2026-12148; the fixed version numbers are unknown from the sources.","status":"open","published_at":"2026-10-19T17:17:17+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-23T22:33:06+00:00","updated_at":"2026-10-23T22:33:06+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-23T22:33:06Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade the IBM MQ Operator to a fixed release listed in the IBM security bulletin for CVE-2026-12148; the fixed version numbers are unknown from the sources.","reach":"network","title":"IBM MQ Operator: authenticated user can crash it or run code","impact":"high","summary":"IBM MQ Operator deserializes untrusted Java objects in its MQ Classes for Java component without restriction. An authenticated attacker can cause a denial of service or potentially execute arbitrary code.","category":"vendor","who_cares":["ibm-mq","kubernetes","openshift","java"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the operator or cluster after authenticating.","analyst_note":"Find the fixed versions and the IBM security bulletin for CVE-2026-12148 (IBM PSIRT advisory, linked from the NVD entry), and confirm which deployment paths are reachable by authenticated users.","how_to_check":"Check the installed MQ Operator version (for example with oc get csv or helm list, depending on how it was installed) and compare it against the affected ranges: 2.0.0 to 2.0.29, 3.2.0 to 3.2.29, and exactly 3.3.0 through 3.6.2 listed individually.","needs_analyst":true,"not_affected_if":["version-outside-listed-ranges","no-mq-operator-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000589,"input_tokens":3220,"output_tokens":533,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-12148':14A,17A '-2026':13A,16A 'advanced':102A,108A,114A,120A,126A,132A,138A,144A,150A,156A,162A,168A,174A 'allow':218C 'arbitrari':212B,231C 'attack':202B,221C 'authent':4A,201B,220C 'caus':204B,223C 'class':194B,241C 'code':11A,213B,232C 'compon':197B 'container':103A,109A,115A,121A,127A,133A,139A,145A,151A,157A,163A,169A,175A 'could':217C 'crash':7A 'cve':12A,15A 'denial':206B,225C 'deseri':187B,237C 'due':233C 'execut':211B,230C 'ibm':1A,18A,21A,24A,27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,99A,105A,111A,117A,123A,129A,135A,141A,147A,153A,159A,165A,171A,178B,184B,214C 'ibm-mq':177B 'images':104A,110A,116A,122A,128A,134A,140A,146A,152A,158A,164A,170A,176A 'java':180B,189B,196B,236C,243C 'kubernet':181B 'mq':2A,19A,22A,25A,28A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A,101A,107A,113A,119A,125A,131A,137A,143A,149A,155A,161A,167A,173A,179B,185B,193B,215C,240C 'object':190B 'openshift':182B 'oper':3A,186B,216C 'operator':20A,23A,26A,29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A 'potenti':210B,229C 'restrict':199B 'run':10A 'servic':208B,227C 'supplied':100A,106A,112A,118A,124A,130A,136A,142A,148A,154A,160A,166A,172A 'unrestrict':235C 'untrust':188B 'user':5A 'vendor':183B 'without':198B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12148","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12148","severity":null,"published_at":"2026-10-19T17:17:17+00:00","modified_at":"2026-10-23T21:00:54+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}