--- id: "CVE-2026-12665" kind: "vulnerability" aliases: ["CVE-2026-12665"] title: "IBM MQ Operator: TLS certificate parsing overflow lets remote attacker run code" severity: "high" cvss: 9.8 epss: null exploited: false status: "open" category: "vendor" products: [{"name": "ibm mq operator", "fixed": [], "affected": ">= 2.0.0, <= 2.0.29", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": ">= 3.2.0, <= 3.2.29", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.3.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.4.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.4.1", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.5.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.5.1", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.5.2", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.5.3", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.6.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.6.1", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.6.2", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.6.3", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.6.4", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.7.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.7.1", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.7.2", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.8.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.8.1", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.9.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.9.1", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 3.9.2", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 4.0.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 4.0.1", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 4.0.2", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 4.0.3", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": [], "affected": "= 4.0.4", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.1.0", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.1.1", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.2.0", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.2.1", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.3.0", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.3.1", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.4.0", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.4.1", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.5.0", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.4.5.1", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 10.0.0.0", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 10.0.0.5", "ecosystem": "vendor"}, {"name": "ibm supplied mq advanced container images", "fixed": [], "affected": "= 9.3.0.0", "ecosystem": "vendor"}, {"name": "ibm mq operator", "fixed": ["4.0.5", "4.1.0"], "affected": ">= 3.3.0, <= 4.0.4", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["ibm-mq", "infrastructure", "kubernetes", "messaging", "openshift", "rce", "tls", "vendor"] not_affected_if: ["no-network-exposure", "unknown"] published_at: "2026-10-19T17:17:18+00:00" first_seen_at: "2026-10-23T21:57:18+00:00" updated_at: "2026-10-23T23:25:44+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12665", "first_seen_at": "2026-10-23T21:57:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:25:44+00:00"}] --- # IBM MQ Operator: TLS certificate parsing overflow lets remote attacker run code Stack buffer overflow in IBM MQ (Operator and MQ Advanced container images) when processing TLS certificates with malformed distinguished names during channel connection setup. Unauthenticated remote code execution, CVSS 8.1 (AC:H). IBM lists no workaround and no TLS setting that avoids it. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:ibm mq operator affected >= 2.0.0, <= 2.0.29 fixed ? - vendor:ibm mq operator affected >= 3.2.0, <= 3.2.29 fixed ? - vendor:ibm mq operator affected = 3.3.0 fixed ? - vendor:ibm mq operator affected = 3.4.0 fixed ? - vendor:ibm mq operator affected = 3.4.1 fixed ? - vendor:ibm mq operator affected = 3.5.0 fixed ? - vendor:ibm mq operator affected = 3.5.1 fixed ? - vendor:ibm mq operator affected = 3.5.2 fixed ? - vendor:ibm mq operator affected = 3.5.3 fixed ? - vendor:ibm mq operator affected = 3.6.0 fixed ? - vendor:ibm mq operator affected = 3.6.1 fixed ? - vendor:ibm mq operator affected = 3.6.2 fixed ? - vendor:ibm mq operator affected = 3.6.3 fixed ? - vendor:ibm mq operator affected = 3.6.4 fixed ? - vendor:ibm mq operator affected = 3.7.0 fixed ? - vendor:ibm mq operator affected = 3.7.1 fixed ? - vendor:ibm mq operator affected = 3.7.2 fixed ? - vendor:ibm mq operator affected = 3.8.0 fixed ? - vendor:ibm mq operator affected = 3.8.1 fixed ? - vendor:ibm mq operator affected = 3.9.0 fixed ? - vendor:ibm mq operator affected = 3.9.1 fixed ? - vendor:ibm mq operator affected = 3.9.2 fixed ? - vendor:ibm mq operator affected = 4.0.0 fixed ? - vendor:ibm mq operator affected = 4.0.1 fixed ? - vendor:ibm mq operator affected = 4.0.2 fixed ? - vendor:ibm mq operator affected = 4.0.3 fixed ? - vendor:ibm mq operator affected = 4.0.4 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.1.0 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.1.1 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.2.0 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.2.1 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.3.0 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.3.1 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.4.0 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.4.1 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.5.0 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.4.5.1 fixed ? - vendor:ibm supplied mq advanced container images affected = 10.0.0.0 fixed ? - vendor:ibm supplied mq advanced container images affected = 10.0.0.5 fixed ? - vendor:ibm supplied mq advanced container images affected = 9.3.0.0 fixed ? - vendor:ibm mq operator affected >= 3.3.0, <= 4.0.4 fixed 4.0.5, 4.1.0 ## How to check List the installed operator version, e.g. kubectl get csv -A | grep -i ibm-mq (OpenShift) or helm list -A, and the queue manager image tag (kubectl get qmgr -A -o yaml, look at spec.version and the image). Exposed if the operator is in 2.0.0-2.0.29, 3.2.0-3.2.29, 3.3.0-3.9.2 or 4.0.0-4.0.4, or the image is in IBM's affected list (9.3.0.x, 9.4.x up to 9.4.0.26-r1 for SC2, 9.4.1.0-9.4.5.x, 10.0.0.0-r1 to 10.0.0.5-r1). ## Fix Upgrade: CD stream to Operator v4.1.0 with MQ Advanced image 10.0.1.0-r1; SC2 stream to Operator v4.0.5 with image 10.0.0.5-r2, or v3.2.30 with image 9.4.0.26-r2. LTS (Operator 2.0.x, images 9.3.0.x): the bulletin lists no fix, so confirm with IBM. Until patched, restrict network access to MQ listener ports to trusted clients. ## Timeline - 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-12665 - 2026-10-23T23:25:44+00:00 analyst — Read IBM bulletin for MQ Operator/container images (primary) and CVE record. Fixed: CD v4.1.0, SC2 v4.0.5 and v3.2.30. No LTS fix listed (v2.0.x). Bulletin says workarounds: None; no TLS setting gates it. No exploitation or PoC found; social not searched. Same CVE also in MQ Appliance bulletin (APAR DT474965), which is a separate product. ## Documents - [advisory] IBM Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images (2026-10-15) https://www.ibm.com/support/pages/security-bulletin-multiple-vulnerabilities-ibm-mq-operator-and-queue-manager-container-images-31 - [describes] CVE Record CVE-2026-12665 (CNA: IBM) https://www.cve.org/CVERecord?id=CVE-2026-12665 - [mentions] IBM Security Bulletin: IBM MQ Appliance stack buffer overflow (CVE-2026-12665) https://www.ibm.com/support/pages/security-bulletin-ibm-mq-appliance-affected-stack-buffer-overflow-vulnerability-cve-2026-12665 ## From the sources IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_