IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computationallyexpensive requests that cause the LLM agent workers to be held for extended periods — rangingfrom tens of seconds to over ten minutes per request. When multiple such requests are sentconcurrently, the agent worker pool becomes exhausted, causing all other IBM MQ Console users toexperience degraded performance or complete unavailability of the AI Agent feature.
Issues mentioned by this security bulletin are addressed in IBM MQ Agent v2.0.2 image.
IBM strongly recommends applying the latest agent images.
IBM MQ Agent v2.0.2 release details:
Image
Fix Version
Registry
Image Location
ibm-mq-agent-runtime
v2.0.2
cp.icr.io
cp.icr.io/cp/ibm-mq-agent-runtime:v2.0.2@sha256:564a3ea85fb601b6bcad4edfd1fe681430d3302338566eb9a554b76e88dc5381
ibm-mq-agent-mcp
v2.0.2
cp.icr.io
cp.icr.io/cp/ibm-mq-agent-mcp:v2.0.2@sha256:400e94ea5312a1307a03e4098506d2e30f7638a0c1410992ce50c59f5cf7a25e
ibm-mq-agent-embedding-service
v2.0.2
cp.icr.io
cp.icr.io/cp/ibm-mq-agent-embedding-service:v2.0.2@sha256:1c324e024462984462a0c7286b7249f76ee1f3bd08000cddf6e431766eea5d7a