Executive brief
IBM MQ Agent CD is an AI-powered assistant integrated into IBM MQ Console that helps users with messaging tasks. An authenticated user can send specially crafted requests that consume excessive computational resources, causing the agent's worker processes to hang for minutes at a time. When multiple such requests are sent, the entire AI Agent feature becomes unavailable to all users, disrupting their ability to use this assistant functionality.
Technical details
This is a denial-of-service vulnerability caused by insufficient input validation and resource limits on computationally expensive requests. An authenticated attacker with a valid session cookie can submit arbitrarily large or computationally expensive payloads to the agent service. These requests cause LLM agent worker threads to be held for extended periods (tens of seconds to over ten minutes each). When multiple concurrent requests are sent, the finite worker thread pool becomes exhausted, preventing legitimate users from accessing the AI Agent feature. The vulnerability affects IBM MQ Agent CD versions 1.0.0, 1.0.1, 2.0.0, and 2.0.1. Authentication is required as a precondition.
Affected products
- IBM MQ Agent CD 1.0.0, 1.0.1, 2.0.0, 2.0.1
Timeline
- 2026-09-04: disclosed