{"api_version":"1","generated_at":"2026-10-22T13:11:21+00:00","cve":"CVE-2026-12660","urls":{"html":"https://cve.report/CVE-2026-12660","api":"https://cve.report/api/cve/CVE-2026-12660.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-12660","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-12660"},"summary":{"title":"IBM MQ Path Traversal","description":"IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.","state":"PUBLISHED","assigner":"ibm","published_at":"2026-10-19 17:17:18","updated_at":"2026-10-20 17:17:38"},"problem_types":["CWE-22","CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"],"metrics":[{"version":"3.1","source":"psirt@us.ibm.com","type":"Secondary","score":"2.7","severity":"LOW","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"2.7","severity":"LOW","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}}],"references":[{"url":"https://www.ibm.com/support/pages/node/7292667","name":"https://www.ibm.com/support/pages/node/7292667","refsource":"psirt@us.ibm.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-12660","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12660","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 3.2.0 3.2.29 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 3.3.0 3.4.0 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 3.4.1 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 3.5.0 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 3.5.1 3.5.3 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 3.6.0 3.6.4 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 3.7.0 3.7.2 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 3.8.0 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 3.8.1 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 3.9.0 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 3.9.1 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 3.9.2 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 4.0.0 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 4.0.1 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 4.0.2 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 4.0.3 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 4.0.4 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Operator","version":"affected 2.0.0 2.0.29 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.6-r1 r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3, 9.4.0.12-r1, 9.4.0.15-r1 - 9.4.0.15-r4, 9.4.0.16-r1, 9.4.0.16-r2, 9.4.0.17-r1, 9.4.0.17-r2, 9.4.0.20-r1, 9.4.0.21-r1, 9.4.0.21-r2, 9.4.0.25-r1 - 9.4.0.25-r3, 9.4.0.26-r1CD: 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1, 9.4.2.0-r1, 9.4.2.0-r2, 9.4.2.1-r1, 9.4.2.1-r2, 9.4.3.0-r1, 9.4.3.0-r2, 9.4.3.1-r1 - 9.4.3.1-r3, 9.4.4.0-r1 - 9.4.4.0-r4, 9.4.4.1-r1, 9.4.5.0-r1, 9.4.5.0-r2, 9.4.5.1-r1, 10.0.0.0-r1 - 10.0.0.0-r4, 10.0.0.5-r1LTS: 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2 semver","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.6-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.7-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.10-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.10-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.11-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.11-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.11-r3","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.12-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.15-r1 9.4.0.15-r4 custom","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.16-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.16-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.17-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.17-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.20-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.21-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.21-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.25-r1 9.4.0.25-r3 custom","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.26-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.1.0-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.1.0-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.1.1-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.2.0-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.2.0-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.2.1-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.2.1-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.3.0-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.3.0-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.3.1-r1 9.4.3.1-r3 custom","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.4.0-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.4.1-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.5.0-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.5.0-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.5.1-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 10.0.0.0-r1 10.0.0.0-r4 custom","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 10.0.0.5-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.0-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.0-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.0-r3","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.1-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.1-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.1-r3","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.1-r4","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.3-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.4-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.4-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.5-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.5-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.5-r3","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.6-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.10-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.10-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.11-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.11-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.15-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.16-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.16-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.17-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.17-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.17-r3","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.20-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.20-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.21-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.21-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.21-r3","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.3.0.25-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.0-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.0-r2","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.0-r3","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.5-r1","platforms":[]},{"source":"CNA","vendor":"IBM","product":"MQ Advanced container images","version":"affected 9.4.0.5-r2","platforms":[]}],"timeline":[],"solutions":[{"source":"CNA","title":"","value":"Issues mentioned by this security bulletin are addressed in -\n\n * IBM MQ Operator v4.1.0 https://www.ibm.com/docs/en/ibm-mq/10.0.x CD release that included IBM supplied MQ Advanced 10.0.1.0-r1 https://www.ibm.com/docs/en/ibm-mq/10.0.x container image. \n * IBM MQ Operator  v4.0.5 https://www.ibm.com/docs/en/ibm-mq/10.0.x SC2 release that included IBM supplied MQ Advanced 10.0.0.5-r2 https://www.ibm.com/docs/en/ibm-mq/10.0.x container image. \n * IBM MQ Operator v3.2.30 https://www.ibm.com/docs/en/ibm-mq/9.4.x SC2 release that included IBM supplied MQ Advanced 9.4.0.26-r2 https://www.ibm.com/docs/en/ibm-mq/9.4.x container image.\n * IBM MQ Container 10.0.1.0-r1 https://www.ibm.com/docs/en/ibm-mq/10.0.x and  10.0.0.5-r2 https://www.ibm.com/docs/en/ibm-mq/10.0.x release.\n\n\n\n\nIBM strongly recommends applying the latest container images. \n\n\n\nIBM MQ Operator v4.1.0 CD release details:\n\n\n\nImage\n\n\n\nFix Version\n\n\n\nRegistry\n\n\n\nImage Location\n\n\n\nibm-mq-operator\n\n\n\nv4.1.0\n\n\n\nicr.io\n\n\n\nicr.io/cpopen/ibm-mq-operator@sha256:ed9a217869637c8749270fd485517ea62c8dffbd198a8f7090042ebbeb5bd127\n\n\n\nibm-mqadvanced-server\n\n\n\n10.0.1.0-r1\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mqadvanced-server@sha256:06f0892b36e879d0f8957477deeabfe2b4e0fda13f64792edbe7825caf7b77e3\n\n\n\nibm-mqadvanced-server-dev\n\n\n\n10.0.1.0-r1\n\n\n\nicr.io\n\n\n\nicr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:129d1d736e94bae071039136585734b7ccc6cfd6e1cc7dacb9af59e60d0a57c2\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nIBM MQ Operator v4.0.5 SC2 release details:\n\n\n\nImage\n\n\n\nFix Version\n\n\n\nRegistry\n\n\n\nImage Location\n\n\n\nibm-mq-operator\n\n\n\nv4.0.5\n\n\n\nicr.io\n\n\n\nicr.io/cpopen/ibm-mq-operator@sha256:1109597707dfb3fbde274e39698f08a9011f13ca75746a30414e246459571930\n\n\n\nibm-mqadvanced-server\n\n\n\n10.0.0.5-r2\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mqadvanced-server@sha256:0218cf9da8c763b502afb02e7c0406654ac64fdd015410d7b73496fbed89a652\n\n\n\nibm-mqadvanced-server-dev\n\n\n\n10.0.0.5-r2\n\n\n\nicr.io\n\n\n\nicr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:6610f615ac4bf129668b70a9ae288386ea6bee87112056b83792ad2f901bcf9b\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nIBM MQ Operator v3.2.30 SC2 release details:\n\n\n\nImage\n\n\n\nFix Version\n\n\n\nRegistry\n\n\n\nImage Location\n\n\n\nibm-mq-operator\n\n\n\nv3.2.30\n\n\n\nicr.io\n\n\n\nicr.io/cpopen/ibm-mq-operator@sha256:57dda3eb0391e540ff18029fdcd44a14951a73860bdc7544be5879a8ca49fc40\n\n\n\nibm-mqadvanced-server\n\n\n\n9.4.0.26-r2\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mqadvanced-server@sha256:4fc5474a0cd9da504bd4bd26ce5c0b91e088656aa56decb315b450ac7868b7e8\n\n\n\nibm-mqadvanced-server-integration\n\n\n\n9.4.0.26-r2\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:a6656d4b9c7db64dd9247c22a00607baf2c9141392d7bf5860a93325604f26ad\n\n\n\nibm-mqadvanced-server-dev\n\n\n\n9.4.0.26-r2\n\n\n\nicr.io\n\n\n\nicr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:abf4c7e931f77aa2aeb340ad054edb35c0f382bf4a7c776d838afab23106b06a\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nIBM MQ Container 10.0.1.0-r1 release details:\n\n\n\nImage\n\n\n\nFix Version\n\n\n\nRegistry\n\n\n\nImage Location\n\n\n\nibm-mqadvanced-server\n\n\n\n10.0.1.0-r1\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mqadvanced-server@sha256:06f0892b36e879d0f8957477deeabfe2b4e0fda13f64792edbe7825caf7b77e3\n\n\n\nibm-mqadvanced-server-dev\n\n\n\n10.0.1.0-r1\n\n\n\nicr.io\n\n\n\nicr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:129d1d736e94bae071039136585734b7ccc6cfd6e1cc7dacb9af59e60d0a57c2\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nIBM MQ Container 10.0.0.5-r2 release details:\n\n\n\nImage\n\n\n\nFix Version\n\n\n\nRegistry\n\n\n\nImage Location\n\n\n\nibm-mqadvanced-server\n\n\n\n10.0.0.5-r2\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mqadvanced-server@sha256:0218cf9da8c763b502afb02e7c0406654ac64fdd015410d7b73496fbed89a652\n\n\n\nibm-mqadvanced-server-dev\n\n\n\n10.0.0.5-r2\n\n\n\nicr.io\n\n\n\nicr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:6610f615ac4bf129668b70a9ae288386ea6bee87112056b83792ad2f901bcf9b","time":"","lang":"en"}],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"12660","cve":"CVE-2026-12660","epss":"0.002400000","percentile":"0.141510000","score_date":"2026-10-20","updated_at":"2026-10-21 00:14:27"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-12660","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-10-20T15:10:09.936450Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-10-20T16:11:26.821Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"MQ Operator","vendor":"IBM","versions":[{"lessThanOrEqual":"3.2.29","status":"affected","version":"3.2.0","versionType":"semver"},{"lessThan":"3.4.0","status":"affected","version":"3.3.0","versionType":"semver"},{"status":"affected","version":"3.4.1","versionType":"semver"},{"status":"affected","version":"3.5.0","versionType":"semver"},{"lessThanOrEqual":"3.5.3","status":"affected","version":"3.5.1","versionType":"semver"},{"lessThanOrEqual":"3.6.4","status":"affected","version":"3.6.0","versionType":"semver"},{"lessThanOrEqual":"3.7.2","status":"affected","version":"3.7.0","versionType":"semver"},{"status":"affected","version":"3.8.0","versionType":"semver"},{"status":"affected","version":"3.8.1","versionType":"semver"},{"status":"affected","version":"3.9.0","versionType":"semver"},{"status":"affected","version":"3.9.1","versionType":"semver"},{"status":"affected","version":"3.9.2","versionType":"semver"},{"status":"affected","version":"4.0.0","versionType":"semver"},{"status":"affected","version":"4.0.1","versionType":"semver"},{"status":"affected","version":"4.0.2","versionType":"semver"},{"status":"affected","version":"4.0.3","versionType":"semver"},{"status":"affected","version":"4.0.4","versionType":"semver"},{"lessThanOrEqual":"2.0.29","status":"affected","version":"2.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","product":"MQ Advanced container images","vendor":"IBM","versions":[{"lessThanOrEqual":"r1, 9.4.0.6-r2, 9.4.0.7-r1, 9.4.0.10-r1, 9.4.0.10-r2, 9.4.0.11-r1, 9.4.0.11-r2, 9.4.0.11-r3, 9.4.0.12-r1, 9.4.0.15-r1 - 9.4.0.15-r4, 9.4.0.16-r1, 9.4.0.16-r2, 9.4.0.17-r1, 9.4.0.17-r2, 9.4.0.20-r1, 9.4.0.21-r1, 9.4.0.21-r2, 9.4.0.25-r1 - 9.4.0.25-r3, 9.4.0.26-r1CD: 9.4.1.0-r1, 9.4.1.0-r2, 9.4.1.1-r1, 9.4.2.0-r1, 9.4.2.0-r2, 9.4.2.1-r1, 9.4.2.1-r2, 9.4.3.0-r1, 9.4.3.0-r2, 9.4.3.1-r1 - 9.4.3.1-r3, 9.4.4.0-r1 - 9.4.4.0-r4, 9.4.4.1-r1, 9.4.5.0-r1, 9.4.5.0-r2, 9.4.5.1-r1, 10.0.0.0-r1 - 10.0.0.0-r4, 10.0.0.5-r1LTS: 9.3.0.0-r1, 9.3.0.0-r2, 9.3.0.0-r3, 9.3.0.1-r1, 9.3.0.1-r2, 9.3.0.1-r3, 9.3.0.1-r4, 9.3.0.3-r1, 9.3.0.4-r1, 9.3.0.4-r2, 9.3.0.5-r1, 9.3.0.5-r2, 9.3.0.5-r3, 9.3.0.6-r1, 9.3.0.10-r1, 9.3.0.10-r2, 9.3.0.11-r1,9.3.0.11-r2, 9.3.0.15-r1, 9.3.0.16-r1, 9.3.0.16-r2, 9.3.0.17-r1, 9.3.0.17-r2, 9.3.0.17-r3, 9.3.0.20-r1, 9.3.0.20-r2, 9.3.0.21-r1, 9.3.0.21-r2, 9.3.0.21-r3, 9.3.0.25-r1, 9.4.0.0-r1, 9.4.0.0-r2, 9.4.0.0-r3, 9.4.0.5-r1, 9.4.0.5-r2","status":"affected","version":"9.4.0.6-r1","versionType":"semver"},{"status":"affected","version":"9.4.0.6-r2"},{"status":"affected","version":"9.4.0.7-r1"},{"status":"affected","version":"9.4.0.10-r1"},{"status":"affected","version":"9.4.0.10-r2"},{"status":"affected","version":"9.4.0.11-r1"},{"status":"affected","version":"9.4.0.11-r2"},{"status":"affected","version":"9.4.0.11-r3"},{"status":"affected","version":"9.4.0.12-r1"},{"lessThanOrEqual":"9.4.0.15-r4","status":"affected","version":"9.4.0.15-r1","versionType":"custom"},{"status":"affected","version":"9.4.0.16-r1"},{"status":"affected","version":"9.4.0.16-r2"},{"status":"affected","version":"9.4.0.17-r1"},{"status":"affected","version":"9.4.0.17-r2"},{"status":"affected","version":"9.4.0.20-r1"},{"status":"affected","version":"9.4.0.21-r1"},{"status":"affected","version":"9.4.0.21-r2"},{"lessThanOrEqual":"9.4.0.25-r3","status":"affected","version":"9.4.0.25-r1","versionType":"custom"},{"status":"affected","version":"9.4.0.26-r1"},{"status":"affected","version":"9.4.1.0-r1"},{"status":"affected","version":"9.4.1.0-r2"},{"status":"affected","version":"9.4.1.1-r1"},{"status":"affected","version":"9.4.2.0-r1"},{"status":"affected","version":"9.4.2.0-r2"},{"status":"affected","version":"9.4.2.1-r1"},{"status":"affected","version":"9.4.2.1-r2"},{"status":"affected","version":"9.4.3.0-r1"},{"status":"affected","version":"9.4.3.0-r2"},{"lessThanOrEqual":"9.4.3.1-r3","status":"affected","version":"9.4.3.1-r1","versionType":"custom"},{"status":"affected","version":"9.4.4.0-r1"},{"status":"affected","version":"9.4.4.1-r1"},{"status":"affected","version":"9.4.5.0-r1"},{"status":"affected","version":"9.4.5.0-r2"},{"status":"affected","version":"9.4.5.1-r1"},{"lessThanOrEqual":"10.0.0.0-r4","status":"affected","version":"10.0.0.0-r1","versionType":"custom"},{"status":"affected","version":"10.0.0.5-r1"},{"status":"affected","version":"9.3.0.0-r1"},{"status":"affected","version":"9.3.0.0-r2"},{"status":"affected","version":"9.3.0.0-r3"},{"status":"affected","version":"9.3.0.1-r1"},{"status":"affected","version":"9.3.0.1-r2"},{"status":"affected","version":"9.3.0.1-r3"},{"status":"affected","version":"9.3.0.1-r4"},{"status":"affected","version":"9.3.0.3-r1"},{"status":"affected","version":"9.3.0.4-r1"},{"status":"affected","version":"9.3.0.4-r2"},{"status":"affected","version":"9.3.0.5-r1"},{"status":"affected","version":"9.3.0.5-r2"},{"status":"affected","version":"9.3.0.5-r3"},{"status":"affected","version":"9.3.0.6-r1"},{"status":"affected","version":"9.3.0.10-r1"},{"status":"affected","version":"9.3.0.10-r2"},{"status":"affected","version":"9.3.0.11-r1"},{"status":"affected","version":"9.3.0.11-r2"},{"status":"affected","version":"9.3.0.15-r1"},{"status":"affected","version":"9.3.0.16-r1"},{"status":"affected","version":"9.3.0.16-r2"},{"status":"affected","version":"9.3.0.17-r1"},{"status":"affected","version":"9.3.0.17-r2"},{"status":"affected","version":"9.3.0.17-r3"},{"status":"affected","version":"9.3.0.20-r1"},{"status":"affected","version":"9.3.0.20-r2"},{"status":"affected","version":"9.3.0.21-r1"},{"status":"affected","version":"9.3.0.21-r2"},{"status":"affected","version":"9.3.0.21-r3"},{"status":"affected","version":"9.3.0.25-r1"},{"status":"affected","version":"9.4.0.0-r1"},{"status":"affected","version":"9.4.0.0-r2"},{"status":"affected","version":"9.4.0.0-r3"},{"status":"affected","version":"9.4.0.5-r1"},{"status":"affected","version":"9.4.0.5-r2"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*","versionEndIncluding":"3.2.29","versionStartIncluding":"3.2.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*","versionEndExcluding":"3.4.0","versionStartIncluding":"3.3.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:3.4.1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:3.5.0:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*","versionEndIncluding":"3.5.3","versionStartIncluding":"3.5.1","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*","versionEndIncluding":"3.6.4","versionStartIncluding":"3.6.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*","versionEndIncluding":"3.7.2","versionStartIncluding":"3.7.0","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:3.8.0:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:3.8.1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:3.9.0:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:3.9.1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:3.9.2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:4.0.0:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:4.0.1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:4.0.2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:4.0.3:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:4.0.4:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_operator:*:*:*:*:*:*:*:*","versionEndIncluding":"2.0.29","versionStartIncluding":"2.0.0","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.6-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.6-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.7-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.10-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.10-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.11-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.11-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.11-r3:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.12-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:*:*:*:*:*:*:*:*","versionEndIncluding":"9.4.0.15-r4","versionStartIncluding":"9.4.0.15-r1","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.16-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.16-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.17-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.17-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.20-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.21-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.21-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:*:*:*:*:*:*:*:*","versionEndIncluding":"9.4.0.25-r3","versionStartIncluding":"9.4.0.25-r1","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.26-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.1.0-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.1.0-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.1.1-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.2.0-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.2.0-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.2.1-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.2.1-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.3.0-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.3.0-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:*:*:*:*:*:*:*:*","versionEndIncluding":"9.4.3.1-r3","versionStartIncluding":"9.4.3.1-r1","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.4.0-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.4.1-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.5.0-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.5.0-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.5.1-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:*:*:*:*:*:*:*:*","versionEndIncluding":"10.0.0.0-r4","versionStartIncluding":"10.0.0.0-r1","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:10.0.0.5-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.0-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.0-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.0-r3:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.1-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.1-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.1-r3:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.1-r4:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.3-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.4-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.4-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.5-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.5-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.5-r3:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.6-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.10-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.10-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.11-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.11-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.15-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.16-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.16-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.17-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.17-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.17-r3:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.20-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.20-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.21-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.21-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.21-r3:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.3.0.25-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.0-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.0-r2:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.0-r3:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.5-r1:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:a:ibm:mq_advanced_container_images:9.4.0.5-r2:*:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.

"}],"value":"IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":2.7,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-19T16:40:20.554Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7292667"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"

Issues mentioned by this security bulletin are addressed in -

IBM strongly recommends applying the latest container images. 

IBM MQ Operator v4.1.0 CD release details:

Image

Fix Version

Registry

Image Location

ibm-mq-operator

v4.1.0

icr.io

icr.io/cpopen/ibm-mq-operator@sha256:ed9a217869637c8749270fd485517ea62c8dffbd198a8f7090042ebbeb5bd127

ibm-mqadvanced-server

10.0.1.0-r1

cp.icr.io

cp.icr.io/cp/ibm-mqadvanced-server@sha256:06f0892b36e879d0f8957477deeabfe2b4e0fda13f64792edbe7825caf7b77e3

ibm-mqadvanced-server-dev

10.0.1.0-r1

icr.io

icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:129d1d736e94bae071039136585734b7ccc6cfd6e1cc7dacb9af59e60d0a57c2

IBM MQ Operator v4.0.5 SC2 release details:

Image

Fix Version

Registry

Image Location

ibm-mq-operator

v4.0.5

icr.io

icr.io/cpopen/ibm-mq-operator@sha256:1109597707dfb3fbde274e39698f08a9011f13ca75746a30414e246459571930

ibm-mqadvanced-server

10.0.0.5-r2

cp.icr.io

cp.icr.io/cp/ibm-mqadvanced-server@sha256:0218cf9da8c763b502afb02e7c0406654ac64fdd015410d7b73496fbed89a652

ibm-mqadvanced-server-dev

10.0.0.5-r2

icr.io

icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:6610f615ac4bf129668b70a9ae288386ea6bee87112056b83792ad2f901bcf9b


IBM MQ Operator v3.2.30 SC2 release details:

Image

Fix Version

Registry

Image Location

ibm-mq-operator

v3.2.30

icr.io

icr.io/cpopen/ibm-mq-operator@sha256:57dda3eb0391e540ff18029fdcd44a14951a73860bdc7544be5879a8ca49fc40

ibm-mqadvanced-server

9.4.0.26-r2

cp.icr.io

cp.icr.io/cp/ibm-mqadvanced-server@sha256:4fc5474a0cd9da504bd4bd26ce5c0b91e088656aa56decb315b450ac7868b7e8

ibm-mqadvanced-server-integration

9.4.0.26-r2

cp.icr.io

cp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:a6656d4b9c7db64dd9247c22a00607baf2c9141392d7bf5860a93325604f26ad

ibm-mqadvanced-server-dev

9.4.0.26-r2

icr.io

icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:abf4c7e931f77aa2aeb340ad054edb35c0f382bf4a7c776d838afab23106b06a

IBM MQ Container 10.0.1.0-r1 release details:

Image

Fix Version

Registry

Image Location

ibm-mqadvanced-server

10.0.1.0-r1

cp.icr.io

cp.icr.io/cp/ibm-mqadvanced-server@sha256:06f0892b36e879d0f8957477deeabfe2b4e0fda13f64792edbe7825caf7b77e3

ibm-mqadvanced-server-dev

10.0.1.0-r1

icr.io

icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:129d1d736e94bae071039136585734b7ccc6cfd6e1cc7dacb9af59e60d0a57c2

IBM MQ Container 10.0.0.5-r2 release details:

Image

Fix Version

Registry

Image Location

ibm-mqadvanced-server

10.0.0.5-r2

cp.icr.io

cp.icr.io/cp/ibm-mqadvanced-server@sha256:0218cf9da8c763b502afb02e7c0406654ac64fdd015410d7b73496fbed89a652

ibm-mqadvanced-server-dev

10.0.0.5-r2

icr.io

icr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:6610f615ac4bf129668b70a9ae288386ea6bee87112056b83792ad2f901bcf9b

"}],"value":"Issues mentioned by this security bulletin are addressed in -\n\n * IBM MQ Operator v4.1.0 https://www.ibm.com/docs/en/ibm-mq/10.0.x CD release that included IBM supplied MQ Advanced 10.0.1.0-r1 https://www.ibm.com/docs/en/ibm-mq/10.0.x container image. \n * IBM MQ Operator  v4.0.5 https://www.ibm.com/docs/en/ibm-mq/10.0.x SC2 release that included IBM supplied MQ Advanced 10.0.0.5-r2 https://www.ibm.com/docs/en/ibm-mq/10.0.x container image. \n * IBM MQ Operator v3.2.30 https://www.ibm.com/docs/en/ibm-mq/9.4.x SC2 release that included IBM supplied MQ Advanced 9.4.0.26-r2 https://www.ibm.com/docs/en/ibm-mq/9.4.x container image.\n * IBM MQ Container 10.0.1.0-r1 https://www.ibm.com/docs/en/ibm-mq/10.0.x and  10.0.0.5-r2 https://www.ibm.com/docs/en/ibm-mq/10.0.x release.\n\n\n\n\nIBM strongly recommends applying the latest container images. \n\n\n\nIBM MQ Operator v4.1.0 CD release details:\n\n\n\nImage\n\n\n\nFix Version\n\n\n\nRegistry\n\n\n\nImage Location\n\n\n\nibm-mq-operator\n\n\n\nv4.1.0\n\n\n\nicr.io\n\n\n\nicr.io/cpopen/ibm-mq-operator@sha256:ed9a217869637c8749270fd485517ea62c8dffbd198a8f7090042ebbeb5bd127\n\n\n\nibm-mqadvanced-server\n\n\n\n10.0.1.0-r1\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mqadvanced-server@sha256:06f0892b36e879d0f8957477deeabfe2b4e0fda13f64792edbe7825caf7b77e3\n\n\n\nibm-mqadvanced-server-dev\n\n\n\n10.0.1.0-r1\n\n\n\nicr.io\n\n\n\nicr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:129d1d736e94bae071039136585734b7ccc6cfd6e1cc7dacb9af59e60d0a57c2\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nIBM MQ Operator v4.0.5 SC2 release details:\n\n\n\nImage\n\n\n\nFix Version\n\n\n\nRegistry\n\n\n\nImage Location\n\n\n\nibm-mq-operator\n\n\n\nv4.0.5\n\n\n\nicr.io\n\n\n\nicr.io/cpopen/ibm-mq-operator@sha256:1109597707dfb3fbde274e39698f08a9011f13ca75746a30414e246459571930\n\n\n\nibm-mqadvanced-server\n\n\n\n10.0.0.5-r2\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mqadvanced-server@sha256:0218cf9da8c763b502afb02e7c0406654ac64fdd015410d7b73496fbed89a652\n\n\n\nibm-mqadvanced-server-dev\n\n\n\n10.0.0.5-r2\n\n\n\nicr.io\n\n\n\nicr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:6610f615ac4bf129668b70a9ae288386ea6bee87112056b83792ad2f901bcf9b\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nIBM MQ Operator v3.2.30 SC2 release details:\n\n\n\nImage\n\n\n\nFix Version\n\n\n\nRegistry\n\n\n\nImage Location\n\n\n\nibm-mq-operator\n\n\n\nv3.2.30\n\n\n\nicr.io\n\n\n\nicr.io/cpopen/ibm-mq-operator@sha256:57dda3eb0391e540ff18029fdcd44a14951a73860bdc7544be5879a8ca49fc40\n\n\n\nibm-mqadvanced-server\n\n\n\n9.4.0.26-r2\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mqadvanced-server@sha256:4fc5474a0cd9da504bd4bd26ce5c0b91e088656aa56decb315b450ac7868b7e8\n\n\n\nibm-mqadvanced-server-integration\n\n\n\n9.4.0.26-r2\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mqadvanced-server-integration@sha256:a6656d4b9c7db64dd9247c22a00607baf2c9141392d7bf5860a93325604f26ad\n\n\n\nibm-mqadvanced-server-dev\n\n\n\n9.4.0.26-r2\n\n\n\nicr.io\n\n\n\nicr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:abf4c7e931f77aa2aeb340ad054edb35c0f382bf4a7c776d838afab23106b06a\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nIBM MQ Container 10.0.1.0-r1 release details:\n\n\n\nImage\n\n\n\nFix Version\n\n\n\nRegistry\n\n\n\nImage Location\n\n\n\nibm-mqadvanced-server\n\n\n\n10.0.1.0-r1\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mqadvanced-server@sha256:06f0892b36e879d0f8957477deeabfe2b4e0fda13f64792edbe7825caf7b77e3\n\n\n\nibm-mqadvanced-server-dev\n\n\n\n10.0.1.0-r1\n\n\n\nicr.io\n\n\n\nicr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:129d1d736e94bae071039136585734b7ccc6cfd6e1cc7dacb9af59e60d0a57c2\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nIBM MQ Container 10.0.0.5-r2 release details:\n\n\n\nImage\n\n\n\nFix Version\n\n\n\nRegistry\n\n\n\nImage Location\n\n\n\nibm-mqadvanced-server\n\n\n\n10.0.0.5-r2\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mqadvanced-server@sha256:0218cf9da8c763b502afb02e7c0406654ac64fdd015410d7b73496fbed89a652\n\n\n\nibm-mqadvanced-server-dev\n\n\n\n10.0.0.5-r2\n\n\n\nicr.io\n\n\n\nicr.io/ibm-messaging/ibm-mqadvanced-server-dev@sha256:6610f615ac4bf129668b70a9ae288386ea6bee87112056b83792ad2f901bcf9b"}],"title":"IBM MQ Path Traversal"}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2026-12660","datePublished":"2026-10-19T16:40:20.554Z","dateReserved":"2026-06-18T18:55:54.084Z","dateUpdated":"2026-10-20T16:11:26.821Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-19 17:17:18","lastModifiedDate":"2026-10-20 17:17:38","problem_types":["CWE-22","CWE-22 CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","baseScore":2.7,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-10-20T15:10:09.936450Z","id":"CVE-2026-12660","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"12660","Ordinal":"1","Title":"IBM MQ Path Traversal","CVE":"CVE-2026-12660","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"12660","Ordinal":"1","NoteData":"IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation.","Type":"Description","Title":"IBM MQ Path Traversal"}]}}}