---
id: "CVE-2026-12550"
kind: "vulnerability"
aliases: ["CVE-2026-12550"]
title: "IBM MQ: improper validation of message selectors leaks data or crashes service"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ibm-mq", "messaging", "package", "self-hosted"]
not_affected_if: ["no-mq-deployment", "version-outside-range"]
published_at: "2026-11-04T21:18:11+00:00"
first_seen_at: "2026-11-04T21:49:22+00:00"
updated_at: "2026-11-04T21:51:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12550", "first_seen_at": "2026-11-04T21:49:22+00:00"}]
exploit_sources: []
---

# IBM MQ: improper validation of message selectors leaks data or crashes service

IBM MQ does not properly validate message selection parameters, so a logged-in user can read sensitive information or trigger a denial of service. The sources list affected releases across MQ 9.2, 9.3, 9.4 and 10.0 but do not describe the exact leak.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed IBM MQ version with `dspmqver` on each queue manager host and compare it to the affected ranges.
- Affected ranges in the sources: 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD.

## Timeline

- 2026-11-04T21:49:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-12550

## From the sources

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to obtain sensitive information or cause a denial of service due to improper validation of message selection parameters.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_