{"id":"CVE-2026-12350","kind":"vulnerability","aliases":["CVE-2026-12350"],"related":[],"title":"IBM MQ Operator: crafted consume request lets an authenticated user crash queue manager","description":"IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process.","summary":"An authenticated IBM MQ client can send a specially crafted asynchronous consume request that crashes the queue manager agent process. The result is a denial of service against the queue manager, with no code execution reported.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm mq operator","fixed":[],"affected":">= 2.0.0, <= 2.0.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":">= 3.2.0, <= 3.2.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.3.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.4","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.4","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.5","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-mq","kubernetes","messaging","vendor"],"not_affected_if":["unauthenticated-only-access"],"how_to_check":"- Check the installed IBM MQ Operator version with `kubectl get csv -A | grep -i mq` or the operator's Helm chart version.\n- Compare the version against the affected ranges: `2.0.0` to `2.0.29`, `3.2.0` to `3.2.29`, and `3.3.0` to `3.6.2` listed exactly.\n- Confirm whether any client account can connect to the queue manager.","fix":"- Move the IBM MQ Operator to a release newer than the affected ranges; the fixed version numbers are unknown from the sources, so check the IBM security bulletin for CVE-2026-12350.\n- Restrict which accounts can connect to the queue manager until the upgrade is applied.","status":"open","published_at":"2026-10-19T17:17:18+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:55:47+00:00","updated_at":"2026-10-25T03:55:47+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:55:47Z","model":"claude-haiku-5-5","output":{"fix":"- Move the IBM MQ Operator to a release newer than the affected ranges; the fixed version numbers are unknown from the sources, so check the IBM security bulletin for CVE-2026-12350.\n- Restrict which accounts can connect to the queue manager until the upgrade is applied.","reach":"network","title":"IBM MQ Operator: crafted consume request lets an authenticated user crash queue manager","impact":"low","summary":"An authenticated IBM MQ client can send a specially crafted asynchronous consume request that crashes the queue manager agent process. The result is a denial of service against the queue manager, with no code execution reported.","category":"vendor","nicknames":[],"who_cares":["ibm-mq","kubernetes","messaging"],"confidence":0.6,"needs_auth":"yes","worst_case":"Queue manager agent process crashes, causing denial of service for messaging","analyst_note":"Fixed versions are unknown from the sources; check the IBM security bulletin for CVE-2026-12350 for the patched operator versions.","how_to_check":"- Check the installed IBM MQ Operator version with `kubectl get csv -A | grep -i mq` or the operator's Helm chart version.\n- Compare the version against the affected ranges: `2.0.0` to `2.0.29`, `3.2.0` to `3.2.29`, and `3.3.0` to `3.6.2` listed exactly.\n- Confirm whether any client account can connect to the queue manager.","needs_analyst":true,"not_affected_if":["unauthenticated-only-access"],"who_is_affected":"Teams running the IBM MQ Operator in the affected version ranges, where at least one authenticated user can reach the queue manager. Installations without any client accounts that can connect have a smaller exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":3612,"output_tokens":645,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-12350':16A,19A '-2026':15A,18A 'advanced':104A,110A,116A,122A,128A,134A,140A,146A,152A,158A,164A,170A,176A 'agent':203B,247C 'allow':224C 'asynchron':195B,239C 'attack':227C 'authent':9A,186B,226C 'caus':229C 'client':189B 'code':218B 'consum':5A,196B,240C 'container':105A,111A,117A,123A,129A,135A,141A,147A,153A,159A,165A,171A,177A 'could':223C 'craft':4A,194B,238C 'crash':11A,199B,243C 'cve':14A,17A 'denial':209B,231C 'execut':219B 'ibm':1A,20A,23A,26A,29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A,101A,107A,113A,119A,125A,131A,137A,143A,149A,155A,161A,167A,173A,180B,187B,221C 'ibm-mq':179B 'images':106A,112A,118A,124A,130A,136A,142A,148A,154A,160A,166A,172A,178A 'kubernet':182B 'let':7A 'manag':13A,202B,215B,246C 'messag':183B 'mq':2A,21A,24A,27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,99A,103A,109A,115A,121A,127A,133A,139A,145A,151A,157A,163A,169A,175A,181B,188B,222C 'oper':3A 'operator':22A,25A,28A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A,100A 'process':204B,248C 'queue':12A,201B,214B,245C 'report':220B 'request':6A,197B,241C 'result':206B 'send':191B,235C 'servic':211B,233C 'special':193B,237C 'supplied':102A,108A,114A,120A,126A,132A,138A,144A,150A,156A,162A,168A,174A 'user':10A 'vendor':184B","nicknames":[],"mitigations":[],"who_affected":"Teams running the IBM MQ Operator in the affected version ranges, where at least one authenticated user can reach the queue manager. Installations without any client accounts that can connect have a smaller exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12350","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12350","severity":null,"published_at":"2026-10-19T17:17:18+00:00","modified_at":"2026-10-23T17:24:36+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}