Vulnerability · Published Jul 24, 2025 · Assigned by ibm

CVE-2025-36005IBM MQ Operator information disclosure

Medium 5.9

In plain English

A medium-severity improper certificate validation in MQ Operator from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.2%top 89.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0 through 3.2.13 Internet Pass-Thru could allow a malicious user to obtain sensitive information from another TLS session connection by the proxy to the same hostname and port due to improper certificate validation.

Affected products (as reported)

Vendor	Product	Versions
IBM	MQ Operator	2.0.0 LTS – through 2.0.29 LTS
IBM	MQ Operator	3.0.0, 3.0.1, 3.1.0, 3.1.3, 3.4.0, 3.5.0, 3.5.1, 3.6.0 CD
IBM	MQ Operator	3.2.0 SC2 – through 3.2.13 SC2

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://www.ibm.com/support/pages/node/7240431 vendor-advisory, patch