CVE-2026-2607: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Published May 15, 2026
·
Updated

IBM MQ Operator SC2: v3.2.0 through 3.2.23CD:  v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 - v3.5.3, v3.6.0 - v3.6.4, v3.7.0 - v3.7.2, v3.8.0, v3.8.1, v3.9.0, v3.9.1LTS: v2.0.0 - 2.0.29 and IBM supplied MQ Advanced container images SC2: 9.4.0.6 through r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3, 9.4.0.12-r1, 9.4.0.15-r1 - 9.4.0.15-r4, 9.4.0.16-r1, 9.4.0.16-r2, 9.4.0.17-r1, 9.4.0.17-r2, 9.4.0.20-r1CD: 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1, 9.4.2.0-r1, 9.4.2.0-r2, 9.4.2.1-r1, 9.4.2.1-r2, 9.4.3.0-r1, 9.4.3.0-r2, 9.4.3.1-r1 - 9.4.3.1-r3, 9.4.4.0-r1 - 9.4.4.0-r4, 9.4.4.1-r1, 9.4.5.0-r1, 9.4.5.0-r2LTS: 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2 IBM MQ stores potentially sensitive information in log files that could be read by a local user.

Affected Software

2 affected components
IBM MQ Operator<=SC2: v3.2.0 - v3.2.23 CD:  v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 - v3.5.3, v3.6.0 - v3.6.4, v3.7.0 - v3.7.2, v3.8.0, v3.8.1, v3.9.0, v3.9.1 LTS: v2.0.0 - 2.0.29
IBM supplied MQ Advanced container images<=SC2: 9.4.0.6-r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3, 9.4.0.12-r1, 9.4.0.15-r1 - 9.4.0.15-r4, 9.4.0.16-r1, 9.4.0.16-r2, 9.4.0.17-r1, 9.4.0.17-r2, 9.4.0.20-r1CD: 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1, 9.4.2.0-r1, 9.4.2.0-r2, 9.4.2.1-r1, 9.4.2.1-r2, 9.4.3.0-r1, 9.4.3.0-r2, 9.4.3.1-r1 - 9.4.3.1-r3, 9.4.4.0-r1 - 9.4.4.0-r4, 9.4.4.1-r1, 9.4.5.0-r1, 9.4.5.0-r2LTS: 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2

Remediation

Information

Issues mentioned by this security bulletin are addressed in - * IBM MQ Operator v3.9.2 CD release that included IBM supplied MQ Advanced 9.4.5.1-r1 container image.  * IBM MQ Operator v3.2.24 SC2 release that included IBM supplied MQ Advanced 9.4.0.21-r1 container image. * IBM MQ Container 9.4.5.0-r2 release. IBM strongly recommends applying the latest container images.  IBM MQ Operator v3.9.2 CD release details: Image Fix Version Registry Image Location ibm-mq-operator v3.9.2 icr.io icr.io/cpopen/ibm-mq-operator@sha256:a62c6c91c4d0acccc8231e8639ecb5da9a49ba8475a2c38655446a2fc22e0fcf ibm-mqadvanced-server 9.4.5.1-r1 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:7b69ef7c554ced9825b450209c304669626082282b9f5eb021b051acea49a1a0 ibm-mqadvanced-server-integration 9.4.5.1-r1 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:b7cc492502f9a8072a47e794697094f8f3607ab745814befd881389a088d8045 ibm-mqadvanced-server-dev 9.4.5.1-r1 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:28cd7e9dc413eced83b21e02cd3683966f19ef22867bbc7ca8c1ed19d062f986 IBM MQ Operator v3.2.24 SC2 release details: Image Fix Version Registry Image Location ibm-mq-operator v3.2.24 icr.io icr.io/cpopen/ibm-mq-operator@sha256:9b99e07fe04f690be7f0c8b60d15b32c72b9964e3043a818eb1339a8ad8b1f3f ibm-mqadvanced-server 9.4.0.21-r1 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:3782667654290147084436f31e21e7890aecb1c86dc0a8906e9eda966123b0fd ibm-mqadvanced-server-integration 9.4.0.21-r1 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:647a2562789ddbd2bcba20c74a3309c349105f0b32357366a22b02c7666d70be ibm-mqadvanced-server-dev 9.4.0.21-r1 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:be50e5e2de4faa4cbeab504e5439a5a1c01a6fe7bfbffc5de0091f1a0457efca IBM MQ Container 9.4.5.1-r1 release details: Image Fix Version Registry Image Location ibm-mqadvanced-server 9.4.5.1-r1 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:7b69ef7c554ced9825b450209c304669626082282b9f5eb021b051acea49a1a0 ibm-mqadvanced-server-dev 9.4.5.1-r1 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:28cd7e9dc413eced83b21e02cd3683966f19ef22867bbc7ca8c1ed19d062f986

Event History

May 15, 2026
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
Affected Software
May 27, 2026
CVE Published
via MITRE·12:20 PM
Data Sourced
via MITRE·12:20 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-2607?

CVE-2026-2607 has a medium severity rating of 5.1.

2

How do I fix CVE-2026-2607?

To remediate CVE-2026-2607, update to IBM MQ Operator v3.9.2 or v3.2.24, which includes the necessary fixes.

3

What vulnerabilities does CVE-2026-2607 address?

CVE-2026-2607 addresses multiple vulnerabilities in IBM MQ Operator and Queue manager container images.

4

Which versions are affected by CVE-2026-2607?

CVE-2026-2607 affects IBM MQ Operator versions from v3.2.0 to v3.9.1 and several IBM supplied MQ Advanced container images.

5

What is the impact of CVE-2026-2607?

CVE-2026-2607 can lead to unauthorized access to sensitive data due to its high confidentiality impact.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203