CVE-2026-12350: CWE-502 Deserialization of Untrusted Data in IBM MQ Operator

IBM MQ Operator contains a deserialization of untrusted data vulnerability (CWE-502) identified as CVE-2026-12350. An authenticated attacker can exploit this by sending a specially crafted asynchronous consume request, which causes the queue manager agent process to crash, resulting in a denial of service condition. The vulnerability affects a wide range of IBM MQ Operator versions, including multiple minor and patch releases from versions 2.0.0 through 4.0.4 and various 9.x and 10.x releases. The CVSS 3.1 score is 6.5 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, indicating network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

The impact of this vulnerability is denial of service (DoS) caused by crashing the queue manager agent process in IBM MQ Operator. This can disrupt message queue operations and potentially affect dependent applications or services relying on the queue manager. There is no indication of confidentiality or integrity compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM's security advisories for updates. In the meantime, restricting access to authenticated users who can send asynchronous consume requests and monitoring for unusual queue manager crashes may help mitigate risk.