IBM MQ Operator contains an unrestricted Java deserialization flaw in the MQ Classes for Java, which can be triggered when an authenticated attacker delivers crafted serialized objects. This flaw is classified as CWE‑502 and can allow the attacker to execute arbitrary code on the host, or at a minimum cause a denial of service by crashing the MQ service.

Affected products include the IBM MQ Advanced container images and IBM MQ Operator. Versions of the operator prior to v4.1.0, v4.0.5, and v3.2.30, as well as container images earlier than 10.0.1.0‑r1 and 10.0.0.5‑r2, have the flaw. The documented fix is available in the listed vendor releases.

The CVSS score of 7.5 reflects a high severity, and no EPSS value is available, so the exact exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. An attacker would need valid credentials to run commands that invoke the deserialization path, so the risk is tied to authenticated access. Because the flaw is in a widely used messaging component, exploitation could impact service availability and confidentiality if deployed in production without mitigation.