Pages Node 7292667
Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images
Vulnerability Details
Affected Products and Versions
Affected Product(s) Version(s) IBM MQ Operator SC2: v3.2.0 - v3.2.29 CD: v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 - v3.5.3, v3.6.0 - v3.6.4, v3.7.0 - v3.7.2, v3.8.0, v3.8.1, v3.9.0, v3.9.1, v3.9.2, v4.0.0, v4.0.1, v4.0.2, v4.0.3, v4.0.4 LTS: v2.0.0 - 2.0.29 IBM supplied MQ Advanced container images SC2: 9.4.0.6-r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3, 9.4.0.12-r1, 9.4.0.15-r1 - 9.4.0.15-r4, 9.4.0.16-r1, 9.4.0.16-r2, 9.4.0.17-r1, 9.4.0.17-r2, 9.4.0.20-r1, 9.4.0.21-r1, 9.4.0.21-r2, 9.4.0.25-r1 - 9.4.0.25-r3, 9.4.0.26-r1 CD: 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1, 9.4.2.0-r1, 9.4.2.0-r2, 9.4.2.1-r1, 9.4.2.1-r2, 9.4.3.0-r1, 9.4.3.0-r2, 9.4.3.1-r1 - 9.4.3.1-r3, 9.4.4.0-r1 - 9.4.4.0-r4, 9.4.4.1-r1, 9.4.5.0-r1, 9.4.5.0-r2, 9.4.5.1-r1, 10.0.0.0-r1 - 10.0.0.0-r4, 10.0.0.5-r1 LTS: 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2
SC2: v3.2.0 - v3.2.29
CD: v3.3.0, v3.4.0, v3.4.1, v3.5.0, v3.5.1 - v3.5.3, v3.6.0 - v3.6.4, v3.7.0 - v3.7.2, v3.8.0, v3.8.1, v3.9.0, v3.9.1, v3.9.2, v4.0.0, v4.0.1, v4.0.2, v4.0.3, v4.0.4
SC2: 9.4.0.6-r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3, 9.4.0.12-r1, 9.4.0.15-r1 - 9.4.0.15-r4, 9.4.0.16-r1, 9.4.0.16-r2, 9.4.0.17-r1, 9.4.0.17-r2, 9.4.0.20-r1, 9.4.0.21-r1, 9.4.0.21-r2, 9.4.0.25-r1 - 9.4.0.25-r3, 9.4.0.26-r1 CD: 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1, 9.4.2.0-r1, 9.4.2.0-r2, 9.4.2.1-r1, 9.4.2.1-r2, 9.4.3.0-r1, 9.4.3.0-r2, 9.4.3.1-r1 - 9.4.3.1-r3, 9.4.4.0-r1 - 9.4.4.0-r4, 9.4.4.1-r1, 9.4.5.0-r1, 9.4.5.0-r2, 9.4.5.1-r1, 10.0.0.0-r1 - 10.0.0.0-r4, 10.0.0.5-r1 LTS: 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2
Issues mentioned by this security bulletin are addressed in - IBM MQ Operator v4.1.0 CD release that included IBM supplied MQ Advanced 10.0.1.0-r1 container image. IBM MQ Operator v4.0.5 SC2 release that included IBM supplied MQ Advanced 10.0.0.5-r2 container image. IBM MQ Operator v3.2.30 SC2 release that included IBM supplied MQ Advanced 9.4.0.26-r2 container image. IBM MQ Container 10.0.1.0-r1 and 10.0.0.5-r2 release. IBM strongly recommends applying the latest container images. IBM MQ Operator v4.1.0 CD release details: Image Fix Version Registry Image Location ibm-mq-operator v4.1.0 icr.io icr.io/cpopen/ibm-mq-operator@sha256:ed9a217869637c8749270fd485517ea62c8dffbd198a8f7090042ebbeb5bd127 ibm-mqadvanced-server 10.0.1.0-r1 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:06f0892b36e879d0f8957477deeabfe2b4e0fda13f64792edbe7825caf7b77e3 ibm-mqadvanced-server-dev 10.0.1.0-r1 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:129d1d736e94bae071039136585734b7ccc6cfd6e1cc7dacb9af59e60d0a57c2 IBM MQ Operator v4.0.5 SC2 release details: Image Fix Version Registry Image Location ibm-mq-operator v4.0.5 icr.io icr.io/cpopen/ibm-mq-operator@sha256:1109597707dfb3fbde274e39698f08a9011f13ca75746a30414e246459571930 ibm-mqadvanced-server 10.0.0.5-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:0218cf9da8c763b502afb02e7c0406654ac64fdd015410d7b73496fbed89a652 ibm-mqadvanced-server-dev 10.0.0.5-r2 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:6610f615ac4bf129668b70a9ae288386ea6bee87112056b83792ad2f901bcf9b IBM MQ Operator v3.2.30 SC2 release details: Image Fix Version Registry Image Location ibm-mq-operator v3.2.30 icr.io icr.io/cpopen/ibm-mq-operator@sha256:57dda3eb0391e540ff18029fdcd44a14951a73860bdc7544be5879a8ca49fc40 ibm-mqadvanced-server 9.4.0.26-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:4fc5474a0cd9da504bd4bd26ce5c0b91e088656aa56decb315b450ac7868b7e8 ibm-mqadvanced-server-integration 9.4.0.26-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:a6656d4b9c7db64dd9247c22a00607baf2c9141392d7bf5860a93325604f26ad ibm-mqadvanced-server-dev 9.4.0.26-r2 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:abf4c7e931f77aa2aeb340ad054edb35c0f382bf4a7c776d838afab23106b06a IBM MQ Container 10.0.1.0-r1 release details: Image Fix Version Registry Image Location ibm-mqadvanced-server 10.0.1.0-r1 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:06f0892b36e879d0f8957477deeabfe2b4e0fda13f64792edbe7825caf7b77e3 ibm-mqadvanced-server-dev 10.0.1.0-r1 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:129d1d736e94bae071039136585734b7ccc6cfd6e1cc7dacb9af59e60d0a57c2 IBM MQ Container 10.0.0.5-r2 release details: Image Fix Version Registry Image Location ibm-mqadvanced-server 10.0.0.5-r2 cp.icr.io cp.icr.io/cp/ibm-mqadvanced-server@sha256:0218cf9da8c763b502afb02e7c0406654ac64fdd015410d7b73496fbed89a652 ibm-mqadvanced-server-dev 10.0.0.5-r2 icr.io icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:6610f615ac4bf129668b70a9ae288386ea6bee87112056b83792ad2f901bcf9b
Issues mentioned by this security bulletin are addressed in -
IBM MQ Operator v4.1.0 CD release that included IBM supplied MQ Advanced 10.0.1.0-r1 container image.
IBM MQ Operator v4.0.5 SC2 release that included IBM supplied MQ Advanced 10.0.0.5-r2 container image.
IBM MQ Operator v3.2.30 SC2 release that included IBM supplied MQ Advanced 9.4.0.26-r2 container image.
IBM MQ Container 10.0.1.0-r1 and 10.0.0.5-r2 release.
IBM strongly recommends applying the latest container images.
IBM MQ Operator v4.1.0 CD release details:
icr.io/cpopen/ibm-mq-operator@sha256:ed9a217869637c8749270fd485517ea62c8dffbd198a8f7090042ebbeb5bd127
ibm-mqadvanced-server
cp.icr.io/cp/ibm-mqadvanced-server@sha256:06f0892b36e879d0f8957477deeabfe2b4e0fda13f64792edbe7825caf7b77e3
ibm-mqadvanced-server-dev
icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:129d1d736e94bae071039136585734b7ccc6cfd6e1cc7dacb9af59e60d0a57c2
IBM MQ Operator v4.0.5 SC2 release details:
icr.io/cpopen/ibm-mq-operator@sha256:1109597707dfb3fbde274e39698f08a9011f13ca75746a30414e246459571930
ibm-mqadvanced-server
cp.icr.io/cp/ibm-mqadvanced-server@sha256:0218cf9da8c763b502afb02e7c0406654ac64fdd015410d7b73496fbed89a652
ibm-mqadvanced-server-dev
icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:6610f615ac4bf129668b70a9ae288386ea6bee87112056b83792ad2f901bcf9b
IBM MQ Operator v3.2.30 SC2 release details:
icr.io/cpopen/ibm-mq-operator@sha256:57dda3eb0391e540ff18029fdcd44a14951a73860bdc7544be5879a8ca49fc40
ibm-mqadvanced-server
cp.icr.io/cp/ibm-mqadvanced-server@sha256:4fc5474a0cd9da504bd4bd26ce5c0b91e088656aa56decb315b450ac7868b7e8
ibm-mqadvanced-server-integration
cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:a6656d4b9c7db64dd9247c22a00607baf2c9141392d7bf5860a93325604f26ad
ibm-mqadvanced-server-dev
icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:abf4c7e931f77aa2aeb340ad054edb35c0f382bf4a7c776d838afab23106b06a
IBM MQ Container 10.0.1.0-r1 release details:
ibm-mqadvanced-server
cp.icr.io/cp/ibm-mqadvanced-server@sha256:06f0892b36e879d0f8957477deeabfe2b4e0fda13f64792edbe7825caf7b77e3
ibm-mqadvanced-server-dev
icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:129d1d736e94bae071039136585734b7ccc6cfd6e1cc7dacb9af59e60d0a57c2
IBM MQ Container 10.0.0.5-r2 release details:
ibm-mqadvanced-server
cp.icr.io/cp/ibm-mqadvanced-server@sha256:0218cf9da8c763b502afb02e7c0406654ac64fdd015410d7b73496fbed89a652
ibm-mqadvanced-server-dev
icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:6610f615ac4bf129668b70a9ae288386ea6bee87112056b83792ad2f901bcf9b
Workarounds and Mitigations
Get Notified Future Security Bulletins
Complete CVSS v3 Guide On-line Calculator v3
15 Oct 2026: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY. In addition to other efforts to address potential vulnerabilities, IBM periodically updates the record of components contained in our product offerings. As part of that effort, if IBM identifies previously unidentified packages in a product/service inventory, we address relevant vulnerabilities regardless of CVE date. Inclusion of an older CVEID does not demonstrate that the referenced product has been used by IBM since that date, nor that IBM was aware of a vulnerability as of that date. We are making clients aware of relevant vulnerabilities as we become aware of them. "Affected Products and Versions" referenced in IBM Security Bulletins are intended to be only products and versions that are supported by IBM and have not passed their end-of-support or warranty date. Thus, failure to reference unsupported or extended-support products and versions in this Security Bulletin does not constitute a determination by IBM that they are unaffected by the vulnerability. Reference to one or more unsupported versions in this Security Bulletin shall not create an obligation for IBM to provide fixes for any unsupported or extended-support products or versions.
Was this topic helpful?
Modified date: 15 October 2026
Initial Publish date: 15 October 2026
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
