CVE-2026-14252: IBM MQ is affected by a pasword disclosure vulnerability in the runmqccred utility
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD stores potentially sensitive information in log files that could be read by a local user.
Other sources
IBM MQ stores potentially sensitive information in log files that could be read by a local user.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.2.0.46 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.3.0.43 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 9.4.0.30 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 10.0.0.6 - Upgrade
Upgrade
IBM MQto a version that resolves this vulnerability.Fixed in 10.0.1.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A local user who can read the relevant IBM MQ log files could obtain potentially sensitive information. The supplied vector indicates no privileges or user interaction are required, but access is local rather than network-based.
Which IBM MQ releases are affected?
Affected releases are 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 in both LTS and CD.
What can be done if updates cannot be applied immediately?
Restrict local access to IBM MQ log files to only users who require it. This reduces the set of users able to read any potentially sensitive information written by the utility.