AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

IBMCVE-2026-19274

IBM Observability with Instana (Agent): improper access control

IBM

CVE-2026-19274 · Published Sep 4, 2026 · updated Sep 8, 2026

Critical9.6
No fix yet
IBM advisory

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR name with no namespace disambiguation, allowing a same-named InstanaAgent CR in an attacker-controlled namespace to silently overwrite the shared ClusterRoleBinding or delete it outright and revoke the victim agent's cluster monitoring access.

Affected versions

PackageAffectedFixed in
Observability with Instana (Agent)
Product
>= Build 1.0.303, <= 1.0.323No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-284

More IBM advisories

All IBM