{"id":"CVE-2026-12669","kind":"vulnerability","aliases":["CVE-2026-12669"],"related":[],"title":"IBM MQ Operator: malformed compressed data triggers minor out-of-bounds read","description":"IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected.","summary":"An authenticated attacker can send malformed compressed data to IBM MQ Operator and trigger a minor out-of-bounds read. The data is not disclosed and the request is rejected.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ibm mq operator","fixed":[],"affected":">= 2.0.0, <= 2.0.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":">= 3.2.0, <= 3.2.29","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.3.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.4.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.5.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.6.4","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.7.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.8.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 3.9.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.0","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.1","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.2","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.3","ecosystem":"vendor"},{"name":"ibm mq operator","fixed":[],"affected":"= 4.0.4","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.1.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.2.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.3.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.4.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.4.5.1","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.0","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 10.0.0.5","ecosystem":"vendor"},{"name":"ibm supplied mq advanced container images","fixed":[],"affected":"= 9.3.0.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ibm-mq","kubernetes","openshift","vendor"],"not_affected_if":["unaffected-version","unauthenticated-only"],"how_to_check":"- Check the installed IBM MQ Operator version with `kubectl get csv -A | grep -i mq` or the OpenShift OperatorHub installed-operators view\n- Compare the version against the affected ranges: `2.0.0` to `2.0.29`, `3.2.0` to `3.2.29`, `3.3.0`, `3.4.0`, `3.4.1`, `3.5.0` to `3.5.3`, `3.6.0` to `3.6.2`","fix":"- Upgrade IBM MQ Operator to a fixed release; the fixed versions are unknown from the sources, see the IBM bulletin linked from NVD","status":"open","published_at":"2026-10-19T17:17:19+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:39:35+00:00","updated_at":"2026-10-25T04:39:35+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:39:35Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade IBM MQ Operator to a fixed release; the fixed versions are unknown from the sources, see the IBM bulletin linked from NVD","reach":"network","title":"IBM MQ Operator: malformed compressed data triggers minor out-of-bounds read","impact":"low","summary":"An authenticated attacker can send malformed compressed data to IBM MQ Operator and trigger a minor out-of-bounds read. The data is not disclosed and the request is rejected.","category":"vendor","nicknames":[],"who_cares":["ibm-mq","kubernetes","openshift"],"confidence":0.7,"needs_auth":"yes","worst_case":"Minor memory read; data not disclosed, request rejected","analyst_note":"Find the fixed versions and the IBM bulletin for CVE-2026-12669 via the NVD link; the sources do not list fixed versions.","how_to_check":"- Check the installed IBM MQ Operator version with `kubectl get csv -A | grep -i mq` or the OpenShift OperatorHub installed-operators view\n- Compare the version against the affected ranges: `2.0.0` to `2.0.29`, `3.2.0` to `3.2.29`, `3.3.0`, `3.4.0`, `3.4.1`, `3.5.0` to `3.5.3`, `3.6.0` to `3.6.2`","needs_analyst":true,"not_affected_if":["unaffected-version","unauthenticated-only"],"who_is_affected":"IBM MQ Operator deployments in the affected version ranges are exposed, and the attacker must already hold valid credentials. Teams running other IBM MQ installs or MQ Operator versions outside the listed ranges can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000677,"input_tokens":3624,"output_tokens":630,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-12669':16A,19A '-2026':15A,18A 'advanced':104A,110A,116A,122A,128A,134A,140A,146A,152A,158A,164A,170A,176A 'allow':219C 'attack':187B,222C 'authent':186B,221C 'bound':12A,204B,230C 'compress':5A,191B,235C 'container':105A,111A,117A,123A,129A,135A,141A,147A,153A,159A,165A,171A,177A 'could':218C 'cve':14A,17A 'data':6A,192B,207B,236C,239C 'disclos':210B,242C 'ibm':1A,20A,23A,26A,29A,32A,35A,38A,41A,44A,47A,50A,53A,56A,59A,62A,65A,68A,71A,74A,77A,80A,83A,86A,89A,92A,95A,98A,101A,107A,113A,119A,125A,131A,137A,143A,149A,155A,161A,167A,173A,180B,194B,216C 'ibm-mq':179B 'images':106A,112A,118A,124A,130A,136A,142A,148A,154A,160A,166A,172A,178A 'kubernet':182B 'malform':4A,190B,234C 'minor':8A,200B,226C 'mq':2A,21A,24A,27A,30A,33A,36A,39A,42A,45A,48A,51A,54A,57A,60A,63A,66A,69A,72A,75A,78A,81A,84A,87A,90A,93A,96A,99A,103A,109A,115A,121A,127A,133A,139A,145A,151A,157A,163A,169A,175A,181B,195B,217C 'openshift':183B 'oper':3A,196B 'operator':22A,25A,28A,31A,34A,37A,40A,43A,46A,49A,52A,55A,58A,61A,64A,67A,70A,73A,76A,79A,82A,85A,88A,91A,94A,97A,100A 'out-of-bound':9A,201B,227C 'read':13A,205B,231C 'reject':215B,247C 'request':213B,245C 'send':189B,233C 'supplied':102A,108A,114A,120A,126A,132A,138A,144A,150A,156A,162A,168A,174A 'though':237C 'trigger':7A,198B,224C 'vendor':184B","nicknames":[],"mitigations":[],"who_affected":"IBM MQ Operator deployments in the affected version ranges are exposed, and the attacker must already hold valid credentials. Teams running other IBM MQ installs or MQ Operator versions outside the listed ranges can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T17:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12669","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12669","severity":null,"published_at":"2026-10-19T17:17:19+00:00","modified_at":"2026-10-23T17:21:01+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}