CVE-2025-12755: IBM MQ Log Injection Vulnerability

CVE-2025-12755 Overview

IBM MQ Operator and IBM-supplied MQ Advanced container images contain a log injection vulnerability (CWE-117) where log messages are not properly neutralized before being written to log files. This flaw could allow an unauthorized user to inject malicious data into MQ log entries, potentially leading to misleading logs, log manipulation, or downstream log-processing issues.

Critical Impact

Attackers with local access can inject arbitrary content into MQ log files, potentially corrupting audit trails, enabling log forgery, or exploiting vulnerabilities in downstream log processing systems such as SIEM platforms.

Affected Products

• IBM MQ Operator SC2 versions 3.2.0 through 3.8.1
• IBM MQ Operator LTS versions 2.0.0 through 2.0.29
• IBM-supplied MQ Advanced container images (SC2, CD, and LTS 9.3.x–9.4.x releases)

Discovery Timeline

• 2026-02-17 - CVE CVE-2025-12755 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-12755

Vulnerability Analysis

This vulnerability stems from improper output neutralization for logs (CWE-117), a common flaw where user-controlled input is written to log files without adequate sanitization. In the context of IBM MQ Operator and associated container images, log messages containing special characters or control sequences are not properly escaped before being written to log files.

The attack requires local access to the system, though no privileges or user interaction are required to exploit the vulnerability. The impact is limited to integrity concerns—specifically the ability to manipulate log content—without affecting confidentiality or availability of the underlying MQ infrastructure.

Root Cause

The root cause is the failure to sanitize or encode log message content before writing to log files. When log entries contain user-supplied data, special characters such as newline characters (\n, \r), ANSI escape sequences, or log format delimiters can be injected to manipulate how logs appear or are processed.

This violation of secure coding practices allows attackers to forge log entries that appear legitimate, hide malicious activity within manipulated logs, or inject payloads that exploit vulnerabilities in log analysis tools that consume these log files.

Attack Vector

The attack vector is local, requiring the attacker to have access to supply input that ends up in MQ log messages. An attacker could craft input containing newline characters and log format prefixes to inject fake log entries that appear authentic.

For example, an attacker might inject a message containing \n[INFO] User admin logged in successfully\n which would create the appearance of a legitimate authentication event in the log file. Similarly, ANSI escape codes or log parser-specific payloads could be injected to manipulate downstream systems that process these logs.

The vulnerability affects containerized deployments using IBM-supplied images, making it particularly relevant in Kubernetes and OpenShift environments where centralized logging and log aggregation are common practices.

Detection Methods for CVE-2025-12755

Indicators of Compromise

• Log entries containing unexpected newline sequences or log format prefixes within message content
• Abnormal log file growth patterns or entries with inconsistent timestamp formatting
• Presence of ANSI escape sequences or control characters in log files
• Log entries that appear duplicated or contain embedded log-formatted strings

Detection Strategies

• Implement log integrity monitoring to detect anomalous patterns or injected content in MQ log files
• Deploy file integrity monitoring (FIM) on MQ log directories to identify unexpected modifications
• Configure SIEM rules to detect log entries with suspicious characters or malformed structures
• Review MQ logs for entries containing escape sequences, carriage returns, or embedded log prefixes

Monitoring Recommendations

• Enable centralized logging with input validation before log aggregation
• Monitor for unusual log entry patterns that may indicate injection attempts
• Implement alerting for log entries containing control characters or format string patterns
• Regularly audit log processing pipelines for proper input sanitization

How to Mitigate CVE-2025-12755

Immediate Actions Required

• Review the IBM Support Page for official patch information and guidance
• Inventory all IBM MQ Operator and MQ Advanced container deployments to identify affected versions
• Prioritize patching for systems where log integrity is critical for compliance or security monitoring
• Implement input validation for any user-controllable data that may appear in MQ logs

Patch Information

IBM has released security updates to address this vulnerability. Administrators should consult the IBM Support Page for specific patch versions and upgrade instructions applicable to their deployment scenario (SC2, LTS, or CD release streams).

For IBM MQ Operator deployments, upgrade to the patched version appropriate for your release stream. For container images, pull the latest patched images from IBM's container registry.

Workarounds

• Implement log output encoding at the application layer to neutralize special characters before logging
• Configure log processing systems to sanitize input before parsing or aggregation
• Restrict local access to systems running affected MQ deployments to reduce exposure
• Deploy network segmentation to limit potential attack paths to affected containers

# Example: Review MQ container image versions for affected deployments
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{range .spec.containers[*]}{.image}{"\n"}{end}{end}' | grep -E "mq|ibm"

# Check MQ Operator version in OpenShift/Kubernetes
kubectl get csv -A | grep ibm-mq