CVE-2026-19645: IBM MQ Agent CD denial of service via oversized requests to LLM agent workers

Summary

IBM MQ Agent CD versions v1.0.0, v1.0.1, v2.0.0 and v2.0.1 are affected by CVE-2026-19645. An authenticated user holding a valid session cookie can submit arbitrarily large or computationally expensive requests that hold LLM agent workers for tens of seconds to over ten minutes each. Concurrent requests of this kind exhaust the agent worker pool, degrading or fully disabling the AI Agent feature for all other IBM MQ Console users.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence
• InfoThe Blind Spots of Detection: Adversarial Perturbation Attacks against Watchdogs in Distributed LLM InferenceSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• HighCVE-2026-118761: Kubeflow Pipelines decompression bomb in pipeline archive uploadSimilar attack · NVD/CVE Database
• LowOpenCode User Hit with Hostile Backlash After Reporting Free AI LoopholeSimilar attack · Socket Blog