Executive brief
IBM MQ Console is a web-based administration tool used to manage message queues and queue managers in enterprise messaging environments. A vulnerability allows authenticated users with read-only access to bypass authorization checks and create or start queue managers, effectively escalating their privileges. This could allow an attacker with limited console access to gain administrative control over critical messaging infrastructure.
Technical details
The vulnerability is an improper authorization check (CWE-285) in the IBM MQ Console REST API that allows authenticated non-administrative users to perform administrative operations. The flaw requires authentication (PR:L) and is remotely exploitable via network (AV:N) with no user interaction needed (UI:N). An attacker with valid read-only credentials can craft requests to create and start queue managers, which should be restricted to administrators. The issue affects MQ versions 9.3.0.0–9.3.5.1 and 9.4.0.0–9.4.5.1, as well as 10.0.0.0. Patches are available: MQ 9.3 LTS requires update 9.3.0.42, MQ 9.4 LTS requires 9.4.0.26, and MQ 9.3/9.4 CD and 10.0.0.0 require upgrade to 10.0.0.5.
Affected products
- IBM MQ 9.3.0.0 to 9.3.5.1; 9.4.0.0 to 9.4.5.1; 10.0.0.0
Timeline
- 2026-09-14: disclosed: Initial publication of security bulletin