{"id":"CVE-2026-19645","state":"PUBLISHED","title":"Multiple vulnerabilities in IBM MQ Agent images","description":"IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods — rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature.","publishedAt":"2026-09-04T15:20:24.432Z","updatedAt":"2026-09-10T21:00:35.296Z","severity":{"score":6.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"ibm"},"assigner":"ibm","products":["IBM MQ Agent"],"affected":[{"vendor":"IBM","product":"MQ Agent","versions":[{"version":"CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1","status":"affected"}],"cpes":["cpe:2.3:a:ibm:mq_agent:cd:*:*:*:*:*:*:*"]}],"references":["https://www.ibm.com/support/pages/node/7285394"],"weaknesses":["CWE-400"],"ingestedAt":"2026-10-29T20:11:10.572Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/19xxx/CVE-2026-19645.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-19645","state":"PUBLISHED","datePublished":"2026-09-04T15:20:24.432Z","dateUpdated":"2026-09-10T21:00:35.296Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2026-08-12T17:12:34.967Z"},"containers":{"cna":{"title":"Multiple vulnerabilities in IBM MQ Agent images","descriptions":[{"lang":"en","value":"IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods — rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature."}],"affected":[{"vendor":"IBM","product":"MQ Agent","versions":[{"version":"CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1","status":"affected"}],"cpes":["cpe:2.3:a:ibm:mq_agent:cd:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7285394","tags":["vendor-advisory","patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH","baseSeverity":"MEDIUM","baseScore":6.5,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-400","lang":"en","description":"CWE-400 Uncontrolled Resource Consumption","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2026-09-04T15:20:24.432Z"},"solutions":[{"lang":"en","value":"Issues mentioned by this security bulletin are addressed in IBM MQ Agent v2.0.2 image.\n\n\n\nIBM strongly recommends applying the latest agent images.\n\n\n\nIBM MQ Agent v2.0.2 release details:\n\n\n\nImage\n\n\n\nFix Version\n\n\n\nRegistry\n\n\n\nImage Location\n\n\n\nibm-mq-agent-runtime\n\n\n\nv2.0.2\n\n\n\ncp.icr.io\n\ncp.icr.io/cp/ibm-mq-agent-runtime:v2.0.2@sha256:564a3ea85fb601b6bcad4edfd1fe681430d3302338566eb9a554b76e88dc5381\n\nibm-mq-agent-mcp\n\n\n\nv2.0.2\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mq-agent-mcp:v2.0.2@sha256:400e94ea5312a1307a03e4098506d2e30f7638a0c1410992ce50c59f5cf7a25e\n\n\n\nibm-mq-agent-embedding-service\n\n\n\nv2.0.2\n\n\n\ncp.icr.io\n\n\n\ncp.icr.io/cp/ibm-mq-agent-embedding-service:v2.0.2@sha256:1c324e024462984462a0c7286b7249f76ee1f3bd08000cddf6e431766eea5d7a","supportingMedia":[{"type":"text/html","base64":false,"value":"<p>Issues mentioned by this security bulletin are addressed in IBM MQ Agent v2.0.2 image.</p><p>IBM strongly recommends applying the latest agent images.</p><p>IBM MQ Agent v2.0.2 release details:</p><div><div><div><div><table><tbody><tr><td><p>Image</p></td><td><p>Fix Version</p></td><td><p>Registry</p></td><td><p>Image Location</p></td></tr><tr><td><p>ibm-mq-agent-runtime</p></td><td><p>v2.0.2</p></td><td><p>cp.icr.io</p></td><td>cp.icr.io/cp/ibm-mq-agent-runtime:v2.0.2@sha256:564a3ea85fb601b6bcad4edfd1fe681430d3302338566eb9a554b76e88dc5381</td></tr><tr><td><p>ibm-mq-agent-mcp</p></td><td><p>v2.0.2</p></td><td><p>cp.icr.io</p></td><td><p>cp.icr.io/cp/ibm-mq-agent-mcp:v2.0.2@sha256:400e94ea5312a1307a03e4098506d2e30f7638a0c1410992ce50c59f5cf7a25e</p></td></tr><tr><td><p>ibm-mq-agent-embedding-service</p></td><td><p>v2.0.2</p></td><td><p>cp.icr.io</p></td><td><p>cp.icr.io/cp/ibm-mq-agent-embedding-service:v2.0.2@sha256:1c324e024462984462a0c7286b7249f76ee1f3bd08000cddf6e431766eea5d7a</p></td></tr></tbody></table></div></div></div></div>"}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-19645","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-10T20:38:37.341225Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-10T21:00:35.296Z"}}]}}}