---
id: "CVE-2026-14252"
kind: "vulnerability"
aliases: ["CVE-2026-14252"]
title: "IBM MQ: sensitive data written to log files readable by local users"
severity: "medium"
cvss: 6.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ibm-mq", "infrastructure", "linux", "messaging", "windows"]
not_affected_if: ["logs-restricted-to-admins", "version-outside-range"]
published_at: "2026-11-04T21:18:12+00:00"
first_seen_at: "2026-11-04T21:49:23+00:00"
updated_at: "2026-11-04T21:51:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14252", "first_seen_at": "2026-11-04T21:49:23+00:00"}]
exploit_sources: []
---

# IBM MQ: sensitive data written to log files readable by local users

IBM MQ versions 9.2, 9.3, 9.4 and 10.0 store potentially sensitive information in log files. A local user on the machine can read those logs and obtain the data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed IBM MQ version (for example with `dspmqver`) and compare it with the affected ranges.
- Review the permissions on the MQ log and error directories to see whether non-administrative local users can read them.

## Timeline

- 2026-11-04T21:49:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-14252

## From the sources

IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD stores potentially sensitive information in log files that could be read by a local user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_