Vulnerability · Published Jul 28, 2026 · Assigned by ibm

CVE-2026-14893IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image

High 7.3

In plain English

A high-severity prototype pollution in Observability with Instana (Agent) from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 73.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.

Affected products (as reported)

Vendor	Product	Versions
IBM	Observability with Instana (Agent)	Build 1.0.303 – through 1.0.320

Weakness: CWE-1321 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

References

https://www.ibm.com/support/pages/node/7281349 vendor-advisory, patch