Vulnerability · Published Sep 4, 2026 · Assigned by ibm

CVE-2026-19274IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Critical 9.6

In plain English

A critical-severity improper access control in Observability with Instana (Agent) from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).

Severity (CVSS 3.1)9.6Critical

Exploit odds (30 days)0.4%top 68.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR name with no namespace disambiguation, allowing a same-named `InstanaAgent` CR in an attacker-controlled namespace to silently overwrite the shared `ClusterRoleBinding` or delete it outright and revoke the victim agent's cluster monitoring access.

Affected products (as reported)

Vendor	Product	Versions
IBM	Observability with Instana (Agent)	Build 1.0.303 – through 1.0.323

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

References

https://www.ibm.com/support/pages/node/7286070 vendor-advisory, patch