CVE-2026-19274
Received Received - Intake

IBM Instana Agent Operator Cluster RBAC Permission Hijack

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: IBM Corporation

Description
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR name with no namespace disambiguation, allowing a same-named `InstanaAgent` CR in an attacker-controlled namespace to silently overwrite the shared `ClusterRoleBinding` or delete it outright and revoke the victim agent's cluster monitoring access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-19274
EUVD
EUVD-2026-71273

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ibm instana_agent From 1.0.303 (inc) to 1.0.323 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves IBM Observability with Instana Agent Operator where an authenticated Kubernetes tenant can hijack or permanently destroy another tenant's cluster-level RBAC permissions. This happens because cluster-scoped RBAC objects are keyed only by the CR name without namespace disambiguation, allowing an attacker to overwrite or delete shared ClusterRoleBindings.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain unauthorized access to monitoring data, disrupt services by revoking cluster monitoring permissions, or cause permanent loss of access for legitimate tenants.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information.

Mitigation Strategies

Upgrade IBM Observability with Instana (Agent) to a version beyond Build 1.0.323 to address the RBAC permission hijacking issue. Review all ClusterRoleBinding resources for unauthorized modifications and ensure no same-named InstanaAgent CRs exist across namespaces.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19274. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart