IBM MQ environments that use the runmqccred utility may write sensitive information, such as passwords and other credentials, to log files. An attacker who gains local user access can read these log files and obtain the disclosed data. The flaw is a weakness in logging practices (CWE‑532). The consequences are limited to confidentiality leakage of stored credentials and other sensitive data and there is no injection, remote code execution, or denial‐of‐service effect reported in the description.

IBM MQ 9.2 LTS versions up to 9.2.0.44, IBM MQ 9.3 LTS versions up to 9.3.0.42, IBM MQ 9.4 LTS versions up to 9.4.0.26, IBM MQ 9.4 CD versions up to 9.4.5.1 CD, and IBM MQ 10.0 LTS and CD versions up to 10.0.0.5.

The vulnerability has a CVSS score of 6.2, indicating moderate severity. No EPSS score is available, and it is not listed in CISA’s KEV catalog. Attack requires local user access to read the log files; remote exploitation is not mentioned. As a result, the risk is primarily to the confidentiality of credentials on systems where local users should not have read access to MQ log files. Organizations that restrict local user privileges or encrypt log files may reduce the impact, but applying vendor patches is recommended because the problem is not mitigated by configuration alone.