IBM MQ Operator EUVD-2026-32271

Local access to the host filesystem where IBM MQ log files are stored, or access to container log output via the Kubernetes/OpenShift logging API (e.g., kubectl logs on the MQ namespace), is required. The CVSS vector confirms local attack vector (AV:L), meaning remote unauthenticated exploitation against IBM MQ Operator across the network is not possible. High attack complexity (AC:H) indicates that specific conditions - likely a particular log verbosity level, operational event sequence, or log rotation state - must be present for sensitive data to appear in the logs; exploitation is not reliable against all deployments at all times. PR:N indicates no elevated privileges are required to trigger the vulnerable logging behavior itself, but practical access to read the resulting log files typically requires some level of system access (local shell on the node, or Kubernetes RBAC permission for pod logs). No user interaction is required once access conditions are satisfied. Exploitation is limited to confidentiality impact only (I:N, A:N) - an attacker cannot modify data or disrupt availability through this vulnerability alone.

The CVSS 3.1 vector AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N presents a nuanced risk picture. The local attack vector (AV:L) rules out remote exploitation, but the high confidentiality impact (C:H) indicates that what is exposed - when accessible - may be meaningfully sensitive, such as authentication credentials or encryption keys. The high attack complexity (AC:H) suggests that specific conditions must be met for the sensitive data to appear in logs, such as particular log verbosity settings or operational timing. PR:N indicates no special privileges are required to trigger the logging behavior itself, though practical access to the log files still implicitly requires some level of local system or container access. No EPSS score was provided in the available data, so exploitation probability cannot be quantified statistically. This CVE is not listed in the CISA KEV catalog, and no publicly available exploit code has been identified. Real-world priority is moderate: the vulnerability is most impactful in multi-tenant Kubernetes/OpenShift environments where non-administrative users may have pod log access via RBAC, or in shared infrastructure where log aggregation pipelines have broad read permissions. Organizations running IBM MQ for financial messaging or regulated workloads should treat this with elevated concern given the likely sensitivity of data transiting MQ.

An attacker with local access to an OpenShift or Kubernetes node hosting IBM MQ Operator - or a developer/operator with kubectl logs access granted through permissive RBAC - reads the container log stream for a running MQ queue manager pod. The logs contain sensitive data written by IBM MQ during normal operation (such as credentials or connection configuration), which the attacker extracts and uses to authenticate to the MQ broker or connected backend systems. No exploit code is required beyond standard filesystem or Kubernetes API access.