EUVD-2026-71259
GHSA-x7m8-9qr5-36gh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Authenticated network access required (PR:L, AV:N); no complexity; availability-only impact fully consistent with resource exhaustion description.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods - rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature.
AnalysisAI
Resource exhaustion in IBM MQ Agent CD (v1.0.0-v2.0.1) allows any authenticated console user to monopolize the LLM agent worker pool by submitting arbitrarily large or computationally expensive requests. When multiple such requests are issued concurrently, all available agent workers remain occupied for extended periods - from tens of seconds to over ten minutes each - causing complete unavailability of the AI Agent feature for all other IBM MQ Console users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated IBM MQ Console session cookie, placing this squarely in the authenticated insider or compromised-credential threat model. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H correctly reflects the moderate-to-high risk profile for availability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | IBM has released a patch and the vendor advisory at https://www.ibm.com/support/pages/node/7285394 should be consulted for the specific fixed version and upgrade instructions; the exact patched version number is not stated in the available data beyond 'patch available from vendor.' As a compensating control prior to patching, administrators should restrict IBM MQ Console access to only the minimum necessary users and enforce strong session management to limit the pool of potential abusers. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today