Search
Find a vulnerability
Search criteria
2 vulnerabilities found for MQ Agent by IBM
CVE-2026-19645 (GCVE-0-2026-19645)
Vulnerability from nvd – Published: 2026-09-04 15:20 – Updated: 2026-09-04 15:20
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in IBM MQ Agent images
Summary
IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods — rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature.
Severity
6.5 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7285394 | vendor-advisorypatch |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:mq_agent:cd:*:*:*:*:*:*:*"
],
"product": "MQ Agent",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods \u2014 rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature.\u003c/p\u003e"
}
],
"value": "IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods \u2014 rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T15:20:24.432Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7285394"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIssues mentioned by this security bulletin are addressed in IBM MQ Agent v2.0.2 image.\u003c/p\u003e\u003cp\u003eIBM strongly recommends applying the latest agent images.\u003c/p\u003e\u003cp\u003eIBM MQ Agent v2.0.2 release details:\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eImage\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eFix Version\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eRegistry\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eImage Location\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eibm-mq-agent-runtime\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003ev2.0.2\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003ecp.icr.io\u003c/p\u003e\u003c/td\u003e\u003ctd\u003ecp.icr.io/cp/ibm-mq-agent-runtime:v2.0.2@sha256:564a3ea85fb601b6bcad4edfd1fe681430d3302338566eb9a554b76e88dc5381\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eibm-mq-agent-mcp\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003ev2.0.2\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003ecp.icr.io\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003ecp.icr.io/cp/ibm-mq-agent-mcp:v2.0.2@sha256:400e94ea5312a1307a03e4098506d2e30f7638a0c1410992ce50c59f5cf7a25e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eibm-mq-agent-embedding-service\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003ev2.0.2\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003ecp.icr.io\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003ecp.icr.io/cp/ibm-mq-agent-embedding-service:v2.0.2@sha256:1c324e024462984462a0c7286b7249f76ee1f3bd08000cddf6e431766eea5d7a\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Issues mentioned by this security bulletin are addressed in IBM MQ Agent v2.0.2 image.\n\n\n\nIBM strongly recommends applying the latest agent images.\n\n\n\nIBM MQ Agent v2.0.2 release details:\n\n\n\nImage\n\n\n\nFix Version\n\n\n\nRegistry\n\n\n\nImage Location\n\n\n\nibm-mq-agent-runtime\n\n\n\nv2.0.2\n\n\n\ncp.icr.io\n\ncp.icr.io/cp/ibm-mq-agent-runtime:v2.0.2@sha256:564a3ea85fb601b6bcad4edfd1fe681430d3302338566eb9a554b76e88dc5381\n\nibm-mq-agent-mcp\n\n\n\nv2.0.2\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mq-agent-mcp:v2.0.2@sha256:400e94ea5312a1307a03e4098506d2e30f7638a0c1410992ce50c59f5cf7a25e\n\n\n\nibm-mq-agent-embedding-service\n\n\n\nv2.0.2\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mq-agent-embedding-service:v2.0.2@sha256:1c324e024462984462a0c7286b7249f76ee1f3bd08000cddf6e431766eea5d7a"
}
],
"title": "Multiple vulnerabilities in IBM MQ Agent images"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-19645",
"datePublished": "2026-09-04T15:20:24.432Z",
"dateReserved": "2026-08-12T17:12:34.967Z",
"dateUpdated": "2026-09-04T15:20:24.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19645 (GCVE-0-2026-19645)
Vulnerability from cvelistv5 – Published: 2026-09-04 15:20 – Updated: 2026-09-04 15:20
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in IBM MQ Agent images
Summary
IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods — rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature.
Severity
6.5 (Medium)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7285394 | vendor-advisorypatch |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:mq_agent:cd:*:*:*:*:*:*:*"
],
"product": "MQ Agent",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods \u2014 rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature.\u003c/p\u003e"
}
],
"value": "IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods \u2014 rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T15:20:24.432Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7285394"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIssues mentioned by this security bulletin are addressed in IBM MQ Agent v2.0.2 image.\u003c/p\u003e\u003cp\u003eIBM strongly recommends applying the latest agent images.\u003c/p\u003e\u003cp\u003eIBM MQ Agent v2.0.2 release details:\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eImage\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eFix Version\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eRegistry\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003eImage Location\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eibm-mq-agent-runtime\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003ev2.0.2\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003ecp.icr.io\u003c/p\u003e\u003c/td\u003e\u003ctd\u003ecp.icr.io/cp/ibm-mq-agent-runtime:v2.0.2@sha256:564a3ea85fb601b6bcad4edfd1fe681430d3302338566eb9a554b76e88dc5381\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eibm-mq-agent-mcp\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003ev2.0.2\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003ecp.icr.io\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003ecp.icr.io/cp/ibm-mq-agent-mcp:v2.0.2@sha256:400e94ea5312a1307a03e4098506d2e30f7638a0c1410992ce50c59f5cf7a25e\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003e\u003cp\u003eibm-mq-agent-embedding-service\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003ev2.0.2\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003ecp.icr.io\u003c/p\u003e\u003c/td\u003e\u003ctd\u003e\u003cp\u003ecp.icr.io/cp/ibm-mq-agent-embedding-service:v2.0.2@sha256:1c324e024462984462a0c7286b7249f76ee1f3bd08000cddf6e431766eea5d7a\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Issues mentioned by this security bulletin are addressed in IBM MQ Agent v2.0.2 image.\n\n\n\nIBM strongly recommends applying the latest agent images.\n\n\n\nIBM MQ Agent v2.0.2 release details:\n\n\n\nImage\n\n\n\nFix Version\n\n\n\nRegistry\n\n\n\nImage Location\n\n\n\nibm-mq-agent-runtime\n\n\n\nv2.0.2\n\n\n\ncp.icr.io\n\ncp.icr.io/cp/ibm-mq-agent-runtime:v2.0.2@sha256:564a3ea85fb601b6bcad4edfd1fe681430d3302338566eb9a554b76e88dc5381\n\nibm-mq-agent-mcp\n\n\n\nv2.0.2\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mq-agent-mcp:v2.0.2@sha256:400e94ea5312a1307a03e4098506d2e30f7638a0c1410992ce50c59f5cf7a25e\n\n\n\nibm-mq-agent-embedding-service\n\n\n\nv2.0.2\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mq-agent-embedding-service:v2.0.2@sha256:1c324e024462984462a0c7286b7249f76ee1f3bd08000cddf6e431766eea5d7a"
}
],
"title": "Multiple vulnerabilities in IBM MQ Agent images"
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-19645",
"datePublished": "2026-09-04T15:20:24.432Z",
"dateReserved": "2026-08-12T17:12:34.967Z",
"dateUpdated": "2026-09-04T15:20:24.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}