CVE-2026-10030: IBM MQ Console Auth Bypass Vulnerability

CVE-2026-10030 Overview

CVE-2026-10030 is an authorization flaw in the IBM MQ Console that allows authenticated non-administrative users to create and start queue managers. The vulnerability stems from improper authorization checks in the web-based management console. Attackers with low-privilege console access can perform actions reserved for administrators, undermining the segregation of duties enforced by IBM MQ role assignments. IBM tracks this issue under CWE-285: Improper Authorization.

Critical Impact
Any authenticated MQ Console user, regardless of assigned role, can create and start queue managers, enabling resource abuse and disruption of messaging infrastructure availability.

Affected Products

IBM MQ Console (see IBM Support Page for affected versions)
IBM MQ web-based management interface
IBM MQ Appliance deployments exposing the Console component

Discovery Timeline

2026-09-18 - CVE-2026-10030 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-10030

Vulnerability Analysis

The IBM MQ Console is the browser-based administrative interface for IBM MQ, used to create, configure, and monitor queue managers. Access to the Console is normally governed by role-based access control, distinguishing administrative users from lower-privileged operator or read-only roles.

CVE-2026-10030 breaks this authorization model. The Console fails to verify that the requesting user holds the administrative role before executing queue manager creation and startup operations. As a result, non-administrative but authenticated users can invoke privileged management functions through the Console.

Successful exploitation affects integrity by allowing unauthorized changes to the messaging topology, and it affects availability by enabling attackers to spawn queue managers that consume system resources such as memory, disk, and TCP ports. Confidentiality is not directly impacted according to the published metrics.

Root Cause

The root cause is missing or incomplete authorization enforcement on privileged Console endpoints. Under [CWE-285], the application authenticates the user but does not correctly validate whether the user's role grants permission to create or start queue managers.

Attack Vector

Exploitation requires network access to the IBM MQ Console and a valid set of low-privilege credentials. No user interaction is required beyond the attacker's own authenticated session. An attacker with any authenticated Console account can issue queue manager creation and startup requests that the server processes without a proper role check. The published EPSS probability is 0.226%.

Refer to the IBM Support Page for the authoritative description of the affected code path and fix.

Detection Methods for CVE-2026-10030

Indicators of Compromise

Queue manager creation or startup events in IBM MQ audit logs attributed to non-administrative accounts.
Unexpected new queue manager processes (amqzxma0, strmqm) on MQ hosts not initiated by change control.
Console HTTP requests to queue manager management endpoints originating from user sessions without the MQWebAdmin role.
Sudden increases in listener ports, disk usage under the MQ data directory, or memory consumption on MQ servers.

Detection Strategies

Correlate IBM MQ Console access logs with role assignments to identify privileged actions performed by non-admin principals.
Alert on strmqm and crtmqm invocations that occur outside approved change windows or automation pipelines.
Baseline the expected set of queue managers per host and alert on deviations.

Monitoring Recommendations

Forward IBM MQ Console access logs and MQ error logs to a centralized SIEM for correlation with identity events.
Monitor authentication events for the mqwebuser registry and flag privilege changes or new user creation.
Track process creation for crtmqm, strmqm, and related MQ binaries on all MQ hosts.

How to Mitigate CVE-2026-10030

Immediate Actions Required

Apply the IBM-provided fix as documented on the IBM Support Page.
Audit all IBM MQ Console user accounts and remove accounts that do not require Console access.
Review recently created queue managers and remove any that were not authorized.
Restrict network access to the MQ Console port (default 9443) to trusted administrative networks only.

Patch Information

IBM has published remediation guidance for CVE-2026-10030 on the IBM Support Page. Apply the interim fix or upgrade to a fixed IBM MQ version as listed in that advisory. Validate the fix in a non-production environment before rolling out to production queue manager hosts.

Workarounds

Disable the IBM MQ Console on hosts where browser-based administration is not required, using setmqweb to stop the mqweb server.
Restrict Console access to administrative accounts by removing non-administrative users from the mqwebuser.xml role mappings until the patch is applied.
Place the MQ Console behind a reverse proxy that enforces additional authentication and IP allow-listing.

bash

# Configuration example: stop the MQ Console until patched
endmqweb

# Restrict Console listener to loopback via mqwebuser.xml / jvm.options
# then restart only after applying the vendor fix
strmqweb