CVE-2026-19274: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image
IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR name with no namespace disambiguation, allowing a same-named InstanaAgent CR in an attacker-controlled namespace to silently overwrite the shared ClusterRoleBinding or delete it outright and revoke the victim agent's cluster monitoring access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Observability with Instana (Agent)to a version that resolves this vulnerability.Fixed in 1.0.324
Event History
Frequently Asked Questions
Which environments are exposed to this issue?
Affected environments are IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 where multiple Kubernetes tenants can create InstanaAgent custom resources in different namespaces. The issue depends on cluster-scoped RBAC objects being named from the bare custom-resource name rather than including its namespace.
What does an attacker need to exploit the vulnerability?
An attacker needs to be an authenticated Kubernetes tenant with control of a namespace and the ability to create an InstanaAgent custom resource. They can use the same InstanaAgent CR name as another tenant to overwrite the shared ClusterRoleBinding or cause its deletion.
What is the practical impact of successful exploitation?
An attacker can hijack another tenant's cluster-level RBAC permissions or permanently remove the victim agent's ClusterRoleBinding. Removing the binding revokes the victim agent's cluster monitoring access.