{"id":"CVE-2026-12660","kind":"vulnerability","aliases":["CVE-2026-12660"],"related":[],"title":"IBM MQ Operator: authenticated admin can write files outside intended directory","description":"IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.","summary":"The IBM MQ Web Console does not validate file paths properly, so an authenticated administrator can write files outside the directory they are meant to use. The sources give a CVSS score of 2.7 and do not describe what files can be written or what follows from it.","severity":"low","cvss":2.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm mq operator","fixed":[],"affected":">= 2.0.0, <= 2.0.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":">= 3.2.0, <= 3.2.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.3.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.4","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.4","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.5","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-mq","ibm-mq-operator","kubernetes","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed IBM MQ Operator version with `unknown`; the sources do not give a command.\n- Compare the version against affected ranges: `2.0.0` to `2.0.29`, `3.2.0` to `3.2.29`, and `3.3.0` through `3.6.2` as listed individually.","fix":"- Move the IBM MQ Operator to a fixed release; the sources do not list the fixed versions (`unknown`).\n- Check the IBM security bulletin for the fixed version for your release line (`unknown`).","status":"open","published_at":"2026-10-19T17:17:18+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:48:06+00:00","updated_at":"2026-10-25T04:48:06+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:48:06Z","model":"claude-haiku-5-5","output":{"fix":"- Move the IBM MQ Operator to a fixed release; the sources do not list the fixed versions (`unknown`).\n- Check the IBM security bulletin for the fixed version for your release line (`unknown`).","reach":"unknown","title":"IBM MQ Operator: authenticated admin can write files outside intended directory","impact":"low","summary":"The IBM MQ Web Console does not validate file paths properly, so an authenticated administrator can write files outside the directory they are meant to use. The sources give a CVSS score of 2.7 and do not describe what files can be written or what follows from it.","category":"vendor","nicknames":[],"who_cares":["ibm-mq","ibm-mq-operator","kubernetes","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated administrator writes files outside the intended directory.","analyst_note":"Find the IBM security bulletin for CVE-2026-12660 to confirm fixed versions and whether the Web Console is enabled by default.","how_to_check":"- Check the installed IBM MQ Operator version with `unknown`; the sources do not give a command.\n- Compare the version against affected ranges: `2.0.0` to `2.0.29`, `3.2.0` to `3.2.29`, and `3.3.0` through `3.6.2` as listed individually.","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Teams running the IBM MQ Operator in the listed version ranges with a Web Console exposed to administrators. Exposure requires an administrator account, so tightly controlled admin access reduces the risk. The sources do not say whether the Web Console is enabled by default.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000669,"input_tokens":3594,"output_tokens":619,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-12660':14A,17A '-2026':13A,16A '2.7':222B 'admin':5A 'administr':203B,243C 'advanced':102A,108A,114A,120A,126A,132A,138A,144A,150A,156A,162A,168A,174A 'allow':240C 'authent':4A,202B,242C 'consol':193B,238C 'container':103A,109A,115A,121A,127A,133A,139A,145A,151A,157A,163A,169A,175A 'could':239C 'cve':12A,15A 'cvss':219B 'describ':226B 'directori':11A,209B,250C 'due':251C 'file':8A,197B,206B,228B,246C 'follow':234B 'give':217B 'host':187B 'ibm':1A,18A,21A,24A,27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,99A,105A,111A,117A,123A,129A,135A,141A,147A,153A,159A,165A,171A,178B,181B,190B,235C 'ibm-mq':177B 'ibm-mq-oper':180B 'images':104A,110A,116A,122A,128A,134A,140A,146A,152A,158A,164A,170A,176A 'improp':253C 'intend':10A,249C 'kubernet':184B 'meant':212B 'mq':2A,19A,22A,25A,28A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A,101A,107A,113A,119A,125A,131A,137A,143A,149A,155A,161A,167A,173A,179B,182B,191B,236C 'oper':3A,183B 'operator':20A,23A,26A,29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A 'outsid':9A,207B,247C 'path':198B,254C 'proper':199B 'score':220B 'self':186B 'self-host':185B 'sourc':216B 'supplied':100A,106A,112A,118A,124A,130A,136A,142A,148A,154A,160A,166A,172A 'use':214B 'valid':196B,255C 'vendor':188B 'web':192B,237C 'write':7A,205B,245C 'written':231B","nicknames":[],"mitigations":[],"who_affected":"Teams running the IBM MQ Operator in the listed version ranges with a Web Console exposed to administrators. Exposure requires an administrator account, so tightly controlled admin access reduces the risk. The sources do not say whether the Web Console is enabled by default.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12660","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12660","severity":null,"published_at":"2026-10-19T17:17:18+00:00","modified_at":"2026-10-23T17:23:33+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}