CVE-2026-19274: CWE-284 Improper Access Control in IBM Observability with Instana (Agent)

IBM Observability with Instana (Agent) versions 1.0.303 through 1.0.323 contain an improper access control vulnerability (CWE-284) in the Instana Agent Operator. The vulnerability arises from cluster-scoped RBAC objects being keyed solely by the CR name without considering namespaces. This design flaw allows an authenticated Kubernetes tenant to create an InstanaAgent CR with the same name in their namespace, which can silently overwrite or delete the shared ClusterRoleBinding. As a result, the attacker can hijack or permanently revoke another tenant's cluster-level RBAC permissions, disrupting their cluster monitoring capabilities.

An authenticated Kubernetes tenant can hijack or permanently destroy another tenant's cluster-level RBAC permissions by exploiting this vulnerability. This leads to loss of cluster monitoring access for the victim tenant and potential disruption of observability functions. The vulnerability does not impact confidentiality but has high impact on integrity and availability of RBAC permissions and monitoring.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated tenant permissions to prevent creation of conflicting InstanaAgent CR names across namespaces. Monitor for unauthorized modifications to ClusterRoleBindings related to Instana Agents. Follow IBM's official guidance once published.