{"id":"CVE-2026-12155","kind":"vulnerability","aliases":["CVE-2026-12155"],"related":[],"title":"IBM MQ Operator: crafted multicast messages crash the queue manager","description":"IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference.","summary":"IBM MQ Operator versions in several ranges mishandle specially crafted multicast status messages, causing a NULL pointer dereference. An authenticated attacker can use this to cause a denial of service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm mq operator","fixed":[],"affected":">= 2.0.0, <= 2.0.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":">= 3.2.0, <= 3.2.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.3.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.4","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.4","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.5","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-mq","kubernetes","messaging","openshift","vendor"],"not_affected_if":["auth-required","not-using-mq-operator"],"how_to_check":"- Check the installed IBM MQ Operator version (for example with `oc get csv` or `kubectl get csv` in the operator namespace) and compare it with the affected ranges: 2.0.0 to 2.0.29, 3.2.0 to 3.2.29, and 3.3.0 to 3.6.2 (specific listed versions).\n- unknown whether the multicast status feature must be enabled for exposure","fix":"- Move IBM MQ Operator to a fixed release listed in the IBM security bulletin for CVE-2026-12155; the sources do not name the fixed version numbers.","status":"open","published_at":"2026-10-19T17:17:17+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:55:51+00:00","updated_at":"2026-10-25T03:55:51+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:55:51Z","model":"claude-haiku-5-5","output":{"fix":"- Move IBM MQ Operator to a fixed release listed in the IBM security bulletin for CVE-2026-12155; the sources do not name the fixed version numbers.","reach":"network","title":"IBM MQ Operator: crafted multicast messages crash the queue manager","impact":"medium","summary":"IBM MQ Operator versions in several ranges mishandle specially crafted multicast status messages, causing a NULL pointer dereference. An authenticated attacker can use this to cause a denial of service.","category":"vendor","nicknames":[],"who_cares":["ibm-mq","kubernetes","openshift","messaging"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated attacker crashes the MQ operator via crafted multicast messages.","analyst_note":"Find the IBM security bulletin and the fixed operator versions for each affected branch; the NVD entry lists no fixed versions.","how_to_check":"- Check the installed IBM MQ Operator version (for example with `oc get csv` or `kubectl get csv` in the operator namespace) and compare it with the affected ranges: 2.0.0 to 2.0.29, 3.2.0 to 3.2.29, and 3.3.0 to 3.6.2 (specific listed versions).\n- unknown whether the multicast status feature must be enabled for exposure","needs_analyst":true,"not_affected_if":["not-using-mq-operator","auth-required"],"who_is_affected":"Teams running the IBM MQ Operator on Kubernetes or OpenShift in the listed version ranges are affected. The attacker must be authenticated, so teams with tight access to the cluster or MQ network have lower practical risk. Teams not running the IBM MQ Operator can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000682,"input_tokens":3613,"output_tokens":641,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-12155':13A,16A '-2026':12A,15A 'advanced':101A,107A,113A,119A,125A,131A,137A,143A,149A,155A,161A,167A,173A 'allow':216C 'attack':203B,219C 'authent':202B,218C 'caus':196B,208B,221C 'container':102A,108A,114A,120A,126A,132A,138A,144A,150A,156A,162A,168A,174A 'could':215C 'craft':4A,192B,229C 'crash':7A 'cve':11A,14A 'denial':210B,223C 'derefer':200B,238C 'ibm':1A,17A,20A,23A,26A,29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A,104A,110A,116A,122A,128A,134A,140A,146A,152A,158A,164A,170A,177B,183B,213C 'ibm-mq':176B 'images':103A,109A,115A,121A,127A,133A,139A,145A,151A,157A,163A,169A,175A 'kubernet':179B 'manag':10A 'messag':6A,180B,195B,232C 'mishandl':190B 'mq':2A,18A,21A,24A,27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,100A,106A,112A,118A,124A,130A,136A,142A,148A,154A,160A,166A,172A,178B,184B,214C 'multicast':5A,193B,230C 'null':198B,236C 'openshift':181B 'oper':3A,185B 'operator':19A,22A,25A,28A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A 'pointer':199B,237C 'queue':9A 'rang':189B 'send':227C 'servic':212B,225C 'sever':188B 'special':191B,228C 'status':194B,231C 'supplied':99A,105A,111A,117A,123A,129A,135A,141A,147A,153A,159A,165A,171A 'trigger':234C 'use':205B 'vendor':182B 'version':186B","nicknames":[],"mitigations":[],"who_affected":"Teams running the IBM MQ Operator on Kubernetes or OpenShift in the listed version ranges are affected. The attacker must be authenticated, so teams with tight access to the cluster or MQ network have lower practical risk. Teams not running the IBM MQ Operator can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12155","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12155","severity":null,"published_at":"2026-10-19T17:17:17+00:00","modified_at":"2026-10-23T21:01:38+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}