{"id":"CVE-2026-12550","kind":"vulnerability","aliases":["CVE-2026-12550"],"related":[],"title":"IBM MQ: improper validation of message selectors leaks data or crashes service","description":"IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message selection parameters.","summary":"IBM MQ does not properly validate message selection parameters, so a logged-in user can read sensitive information or trigger a denial of service. The sources list affected releases across MQ 9.2, 9.3, 9.4 and 10.0 but do not describe the exact leak.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-mq","messaging","package","self-hosted"],"not_affected_if":["no-mq-deployment","version-outside-range"],"how_to_check":"- Check the installed IBM MQ version with `dspmqver` on each queue manager host and compare it to the affected ranges.\n- Affected ranges in the sources: 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD.","fix":null,"status":"open","published_at":"2026-11-04T21:18:11+00:00","first_seen_at":"2026-11-04T21:49:22+00:00","triaged_at":"2026-11-04T21:51:24+00:00","updated_at":"2026-11-04T21:51:24+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T21:51:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM MQ: improper validation of message selectors leaks data or crashes service","impact":"medium","summary":"IBM MQ does not properly validate message selection parameters, so a logged-in user can read sensitive information or trigger a denial of service. The sources list affected releases across MQ 9.2, 9.3, 9.4 and 10.0 but do not describe the exact leak.","audience":"businesses","category":"package","nicknames":[],"who_cares":["ibm-mq","messaging","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reads sensitive data or crashes the queue manager","analyst_note":"Find IBM's security bulletin for CVE-2026-12550 to confirm fixed versions per branch and the exact data exposed.","how_to_check":"- Check the installed IBM MQ version with `dspmqver` on each queue manager host and compare it to the affected ranges.\n- Affected ranges in the sources: 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range","no-mq-deployment"],"who_is_affected":"Teams running IBM MQ message brokers within the listed version ranges are exposed, and the attacker must already hold valid MQ credentials. Systems on versions outside these ranges, or without any MQ deployment, can skip it. The sources do not describe a specific non-default configuration.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000752,"input_tokens":4239,"output_tokens":657,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-12550':15A,18A '-2026':14A,17A '10.0':63B '10.0.0.0':90C '10.0.0.5':92C '9.2':59B '9.2.0.0':73C '9.2.0.44':75C '9.3':60B '9.3.0.0':77C '9.3.0.42':79C '9.4':61B '9.4.0.0':81C,85C '9.4.0.26':83C '9.4.5.1':87C 'across':57B 'affect':55B 'allow':97C 'attack':100C 'authent':99C 'caus':106C 'cd':88C,95C 'could':96C 'crash':11A 'cve':13A,16A 'data':9A 'denial':49B,108C 'describ':67B 'due':111C 'exact':69B 'host':26B 'ibm':1A,20B,27B,71C 'ibm-mq':19B 'improp':3A,113C 'inform':45B,104C 'leak':8A,70B 'list':54B 'log':39B 'logged-in':38B 'lts':76C,80C,84C,93C 'messag':6A,22B,33B,116C 'mq':2A,21B,28B,58B,72C 'obtain':102C 'packag':23B 'paramet':35B,118C 'proper':31B 'read':43B 'releas':56B 'select':34B,117C 'selector':7A 'self':25B 'self-host':24B 'sensit':44B,103C 'servic':12A,51B,110C 'sourc':53B 'trigger':47B 'user':41B 'valid':4A,32B,114C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM MQ message brokers within the listed version ranges are exposed, and the attacker must already hold valid MQ credentials. Systems on versions outside these ranges, or without any MQ deployment, can skip it. The sources do not describe a specific non-default configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmmq","medium","messaging","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T21:18:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12550","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12550","severity":null,"published_at":"2026-11-04T21:18:11+00:00","modified_at":"2026-11-04T21:18:11+00:00","first_seen_at":"2026-11-04T21:49:22+00:00","fetched_at":"2026-11-04T21:49:22+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}