Log Injection Vulnerability in IBM MQ Operator and Container Images
CVE-2025-12755

4MEDIUM

Key Information:

Vendor

IBM
Status
MQ Operator
Supplied MQ Advanced Container Images
Vendor
CVE Published:
17 February 2026

What is CVE-2025-12755?

IBM MQ Operator and related container images have a vulnerability that allows unauthorized users to inject malicious data into log messages. This issue arises from inadequate neutralization of log entries, which could lead to misleading logs and potential log manipulation. Security teams should be aware of the implications of compromised log integrity and the risks associated with downstream log processing. Upgrading to the latest versions and applying patches issued by IBM is crucial to mitigate this risk.

Affected Version(s)

MQ Operator SC2: v3.2.0 <= 3.2.21

MQ Operator CD:  v3.3.0 <= 3.8.1

MQ Operator LTS: v2.0.0 <= 2.0.29

References

https://www.ibm.com/support/pages/node/7260087
vendor-advisorypatch

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.