CVE-2024-40681: IBM MQ Operator Auth Bypass Vulnerability

CVE-2024-40681 Overview

CVE-2024-40681 is a security bypass vulnerability affecting IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD. The flaw allows an authenticated user assigned to a specifically defined role to bypass security restrictions and execute unauthorized actions against the queue manager. The vulnerability is classified under [CWE-266] (Incorrect Privilege Assignment) and impacts both the IBM MQ Operator and IBM-supplied MQ Advanced container images. Successful exploitation compromises the confidentiality, integrity, and availability of message-queuing infrastructure that often underpins critical enterprise transaction processing.

Critical Impact
An authenticated MQ user in a specific role can bypass access controls on the queue manager, enabling unauthorized administrative actions against messaging infrastructure.

Affected Products

IBM MQ Operator (LTS, CD, and SC2 channels, including versions 3.0.0 and 3.0.1 CD)
IBM-supplied MQ Advanced container images versions 9.2.0.x through 9.4.0.0
IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD deployments

Discovery Timeline

2024-09-07 - CVE-2024-40681 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-40681

Vulnerability Analysis

The vulnerability resides in IBM MQ's role-based access control enforcement. An authenticated user placed in a specific role can perform queue manager actions that should be restricted by the security model. IBM MQ is a message-oriented middleware platform used to transport transactional messages between distributed applications, and the queue manager is the central authority controlling access to queues, channels, and administrative commands. When role permissions are evaluated incorrectly, actions such as queue creation, deletion, or message manipulation may proceed without proper authorization.

The attack requires network access to the MQ listener and valid credentials, which lowers the barrier for insiders or attackers who have obtained stolen credentials. Exploitation does not require user interaction and can be scripted through standard MQ administration tooling.

Root Cause

The underlying issue is incorrect privilege assignment ([CWE-266]) within the queue manager's authorization logic. Specific role definitions grant broader capabilities than intended, allowing bypass of the object-level authority checks that MQ normally applies through the Object Authority Manager (OAM).

Attack Vector

An attacker authenticates to the queue manager over the network using credentials tied to the vulnerable role. Once authenticated, the attacker issues MQSC or PCF administrative commands, or interacts with queue objects, in ways that should be denied. Because the flaw affects both bare-metal MQ installations and containerized deployments managed by the MQ Operator, both on-premises and Kubernetes/OpenShift environments are exposed.

No verified public exploit code is available. The vulnerability mechanism should be understood through IBM's official advisory rather than synthetic proof-of-concept code. See the IBM Support Page for technical details.

Detection Methods for CVE-2024-40681

Indicators of Compromise

Queue manager audit log entries showing successful administrative actions (create, alter, delete on queues, channels, or authority records) performed by user accounts that should not possess those privileges.
Unexpected MQSC or PCF command executions originating from application service accounts rather than administrator accounts.
Changes to authority records (SET AUTHREC, DELETE AUTHREC) not correlated with a documented change ticket.

Detection Strategies

Enable and forward IBM MQ authorization event messages from SYSTEM.ADMIN.QMGR.EVENT and authority event queues to a centralized SIEM for correlation.
Baseline the set of users and roles that legitimately perform administrative actions and alert on deviations.
Review MQ error logs (AMQERR01.LOG) for authorization warnings and unusual channel activity from authenticated principals.

Monitoring Recommendations

Continuously monitor queue manager configuration drift, including authority records, channel authentication records (CHLAUTH), and connection authentication settings.
Alert on privilege changes to MQ service accounts and on new role bindings within the MQ Operator custom resources in Kubernetes.
Correlate MQ audit events with identity provider logs to identify anomalous authentication patterns preceding administrative actions.

How to Mitigate CVE-2024-40681

Immediate Actions Required

Apply the fixed IBM MQ versions and MQ Operator releases identified in the IBM security bulletin as soon as change windows permit.
Audit all role assignments on affected queue managers and remove users from the specifically defined role identified in IBM's advisory until patched.
Rotate credentials for MQ administrative and application service accounts if unauthorized activity is suspected.

Patch Information

IBM has published fix information in the official advisory. Refer to the IBM Support Page for CVE-2024-40681 for the specific fix packs, container image tags, and MQ Operator versions that remediate the vulnerability across 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD.

Workarounds

Restrict membership of the affected role to the minimum set of trusted administrators until patches are deployed.
Enforce strict CHLAUTH rules and TLS mutual authentication on all queue manager channels to limit which principals can authenticate.
Segment MQ listener ports behind network access controls so that only trusted application hosts can reach the queue manager.

bash

# Configuration example: restrict channel access and remove broad authority grants
runmqsc QMGR <<EOF
SET CHLAUTH('*') TYPE(ADDRESSMAP) ADDRESS('*') USERSRC(NOACCESS) ACTION(REPLACE)
SET CHLAUTH('APP.SVRCONN') TYPE(ADDRESSMAP) ADDRESS('10.0.0.0/24') USERSRC(CHANNEL) ACTION(REPLACE)
REFRESH SECURITY TYPE(AUTHSERV)
DISPLAY AUTHREC OBJTYPE(QMGR) ALL
EOF