CVE-2026-19274

CriticalCVSS 9.6

Published: 04/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Summary

Risk Assessment

An attacking tenant can overwrite or delete shared ClusterRoleBindings, potentially leading to loss of cluster monitoring access for the victim or privilege escalation.

Recommendation

Update IBM Instana Agent Operator to a patched version or apply mitigations such as namespace-based access controls.

Other vulnerabilities in IBM Instana Agent Operator

CVE-2026-19283High
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 and IBM Instana Agent Operator may allow an authenticated remote attacker to obtain sensitive information due to missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system namespace into an attacker-controlled namespace.

Original NVD description (English source)

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR name with no namespace disambiguation, allowing a same-named `InstanaAgent` CR in an attacker-controlled namespace to silently overwrite the shared `ClusterRoleBinding` or delete it outright and revoke the victim agent's cluster monitoring access.