CVE-2021-38949: IBM Mq

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 211403.

Affected products

• IBM Mq: from 8.0.0.0, before 8.0.0.14 (fixed in 8.0.0.14); from 9.0.0.0, before 9.0.0.9 (fixed in 9.0.0.9); from 9.1.0, before 9.1.5 (fixed in 9.1.5); from 9.1.0.0, before 9.1.0.5 (fixed in 9.1.0.5)
• IBM WebSphere Mq: version 7.5 only

Published 2021-11-16. Last modified 2026-06-17.