CVE-2026-10743: CWE-1223 Race Condition for Write-Once Attributes in IBM MQ Operator

IBM MQ Operator contains a race condition vulnerability (CWE-1223) related to write-once attributes. This flaw arises from improper validation of buffer sizes during MQOPEN operations, which could be exploited by an authenticated attacker to cause denial of service or corrupt memory. The vulnerability has a CVSS 3.1 score of 8.8, indicating high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality, integrity, and availability. Multiple versions of IBM MQ Operator are affected, spanning various 2.x, 3.x, 4.x, 9.x, and 10.x releases as explicitly enumerated.

Successful exploitation allows an authenticated attacker to cause denial of service or memory corruption in IBM MQ Operator, potentially disrupting message queue operations and compromising system stability and security. The impact affects confidentiality, integrity, and availability of the affected system components.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to IBM MQ Operator to trusted authenticated users only and monitor for unusual MQOPEN operation behavior.