CVE-2026-2607: IBM MQ Information Disclosure Flaw

CVE-2026-2607 Overview

CVE-2026-2607 is an information disclosure vulnerability affecting IBM MQ Operator and IBM-supplied MQ Advanced container images. IBM MQ writes potentially sensitive information to log files that are readable by local users on the affected system. The flaw is classified under CWE-532: Insertion of Sensitive Information into Log File. Exploitation requires local access, but no authentication or user interaction is necessary to read the exposed data once access is obtained. The issue affects a broad range of IBM MQ Operator versions across the SC2, CD, and LTS release streams, as well as numerous MQ Advanced container image builds.

Critical Impact

Local users with read access to IBM MQ log files can obtain sensitive information that may aid lateral movement, credential reuse, or escalation within the messaging infrastructure.

Affected Products

• IBM MQ Operator SC2 v3.2.0 through 3.2.23, CD v3.3.0 through v3.9.1, LTS v2.0.0 through 2.0.29
• IBM MQ Advanced container images SC2 9.4.0.6-r1 through 9.4.0.20-r1, CD 9.4.1.0-r1 through 9.4.5.0-r2
• IBM MQ Advanced container images LTS 9.3.0.0-r1 through 9.4.0.5-r2

Discovery Timeline

• 2026-05-27 - CVE-2026-2607 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-2607

Vulnerability Analysis

The vulnerability stems from improper handling of sensitive data within the IBM MQ logging subsystem. IBM MQ writes diagnostic, operational, or configuration data to log files without consistently redacting sensitive fields. A local user with access to the container filesystem, the underlying node, or a mounted log volume can read these files and recover the exposed information.

The attack vector is local, and the attack complexity is high because an attacker must already have a foothold on the host or within the container environment where log files reside. The impact is limited to confidentiality, with no direct integrity or availability consequences. The exposed data may include configuration details, queue manager metadata, or other operational artifacts that assist follow-on attacks against the messaging fabric.

Root Cause

The root cause is the inclusion of sensitive information in log output, which falls under CWE-532. IBM MQ components log data that should be either omitted, masked, or stored in access-controlled locations. Default file permissions on the affected log paths permit read access to local users, compounding the disclosure risk.

Attack Vector

An attacker first needs local access to a system running an affected IBM MQ Operator deployment or MQ Advanced container. This may include nodes in the Kubernetes or OpenShift cluster hosting the operator, sidecar containers sharing log volumes, or hosts where log aggregation collects MQ output. Once positioned, the attacker reads the log files directly. No exploitation tooling is required because the issue is passive disclosure rather than active code execution. See the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-2607

Indicators of Compromise

• Unexpected read access to IBM MQ log directories such as /var/mqm/errors/ or operator log paths by accounts that do not require it
• Log aggregation pipelines or sidecar containers retrieving MQ logs to destinations outside the approved telemetry path
• Local shell sessions on cluster nodes enumerating files under MQ persistent volume claims

Detection Strategies

• Audit filesystem access events on IBM MQ log directories using Linux audit rules and forward the events to a centralized analytics platform
• Inventory IBM MQ Operator and MQ Advanced container image versions against the affected version list to identify exposed deployments
• Review Kubernetes RBAC and pod security context settings that grant exec or volume access into MQ pods

Monitoring Recommendations

• Monitor for kubectl exec or oc exec sessions targeting MQ pods, especially by service accounts not associated with operations
• Alert on copy operations such as kubectl cp extracting files from MQ log paths
• Track changes to file permissions or ownership on MQ log directories that could broaden read access

How to Mitigate CVE-2026-2607

Immediate Actions Required

• Identify all IBM MQ Operator and MQ Advanced container image versions deployed in your environment and compare against the affected list
• Restrict local and cluster-level access to nodes and pods running IBM MQ to operations personnel only
• Rotate any credentials, certificates, or tokens that may have been written to MQ log files prior to remediation

Patch Information

IBM has published remediation guidance on the IBM Support Page for CVE-2026-2607. Upgrade IBM MQ Operator and MQ Advanced container images to a fixed release as specified in the IBM advisory. Apply fixes through the standard operator subscription channel or by updating container image tags in your deployment manifests.

Workarounds

• Tighten filesystem permissions on MQ log directories so only the MQ runtime user can read them, where operationally feasible
• Mount MQ log volumes with restrictive fsGroup and runAsUser settings to limit cross-container access
• Sanitize log forwarding pipelines to strip sensitive fields before logs are persisted to long-term storage

# Example: restrict access to MQ log directory on a node
chown -R mqm:mqm /var/mqm/errors
chmod -R 750 /var/mqm/errors