IBM MQ Operator: Unsafe Java deserialization in MQ Classes for Java
Summary
IBM MQ Operator, which deploys IBM MQ queue managers on Kubernetes or OpenShift, contains unrestricted Java deserialization in the MQ Classes for Java (CWE-502). An authenticated attacker with valid credentials can cause a denial of service or potentially execute arbitrary code. The CVSS score differs between sources (8.8 in the CVE record, 7.5 in other records), so verify it in NVD before reporting.
Affected
- IBM MQ Operator 3.2.0 to 3.2.29, 3.3.0 to below 3.4.0, 3.4.1, 3.5.0, 3.5.1 to 3.5.3, 3.6.0 to 3.6.4, 3.7.0 to 3.7.2, 3.8.0, 3.8.1, 3.9.0 to 3.9.2 (per the CVE record)
- IBM MQ Advanced container images in several 9.3.x, 9.4.x, 10.0.0.x and 9.4.1.x to 9.4.5.x builds (see the IBM bulletin for the full list)
- Unknown: whether operator versions 4.0.x are affected (sources conflict)
Fixed in
- MQ Operator v4.1.0 with MQ Advanced 10.0.1.0-r1
- MQ Operator v4.0.5 SC2 with MQ Advanced 10.0.0.5-r2
- MQ Operator v3.2.30 SC2 with MQ Advanced 9.4.0.26-r2
- MQ Container 10.0.1.0-r1 and 10.0.0.5-r2
- Unknown: fixed releases for the 3.3.x to 3.9.x branches
Workaround
Unknown. IBM has not published a workaround for this CVE in the sources reviewed. Generic measures such as restricting access to the MQ service and monitoring for deserialization attempts reduce risk but are not vendor guidance.
Exploitation
- CISA SSVC: exploitation none, not automatable, total technical impact
- Not listed in CISA KEV; EPSS below 1%
- No public proof of concept reported by one aggregator; no evidence of in-the-wild exploitation at publication
Our recommendation
- Inventory MQ Operator and MQ Advanced image versions in all Kubernetes and OpenShift clusters
- Upgrade to the fixed releases listed above, or contact IBM for the fix path for your branch
- Restrict access to MQ and its management endpoints to authorised users and networks and avoid internet exposure
- Monitor MQ logs for unusual deserialization errors or unexpected process activity
- Verify the CVSS score in NVD
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7292667 www.ibm.com
- OpenCVE CVE-2026-12148 app.opencve.io
- HOL Guard CVE-2026-12148 hol.org
- VulDB 422442 vuldb.com
- Strix CVE-2026-12148 www.strix.ai
- The Hacker Wire CVE-2026-12148 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:46.
Original description (NVD)
IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.