Volerion logoVolerion
Volerion logoVolerion

IBM MQ Log Injection Vulnerability in Operator and Advanced Container Images

Vulnerability

A vulnerability exists in IBM MQ Operator versions 3.2.0 to 3.8.1 and in IBM-supplied MQ Advanced container images across several affected releases. The issue arises because log messages are not properly sanitized before being written to log files. This flaw could enable an unauthorized user to inject malicious data into MQ log entries, potentially causing log manipulation, misleading log information, or issues with downstream log processing.

Impact

Exploitation of this vulnerability could lead to unauthorized log injection, allowing for log manipulation or the introduction of misleading log entries that could disrupt normal log processing activities.

Remediation

Users can upgrade to IBM MQ Operator version 3.9.0 or 3.2.22, both of which include the patched IBM MQ Advanced 9.4.5.0-r1 container image. Alternatively, IBM MQ Container version 9.4.5.0-r1 is also available.

Added: Feb 17, 2026, 7:51 PM
Updated: Feb 17, 2026, 7:51 PM

Vulnerability Rating

Custom Algorithm
spread
1.2
impact
1.3
exploitability
3.3
remediation
7.7
relevance
3.1
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.