CVE-2026-19283: CWE-863 Incorrect Authorization in IBM Observability with Instana (Agent)

IBM Observability with Instana (Agent) versions 1.0.303 through 1.0.323 contain an authorization flaw (CWE-863) in the IBM Instana Agent Operator. The issue arises because the software fails to validate the destination namespace when copying etcd mTLS client credentials from the openshift-etcd system namespace. An authenticated remote attacker with privileges to interact with the agent operator can exploit this to access sensitive credentials by copying them into a namespace they control. This could lead to unauthorized disclosure of sensitive information.

An authenticated remote attacker with limited privileges can obtain sensitive etcd mTLS client credentials by exploiting the missing namespace validation. This results in a confidentiality breach, potentially allowing further unauthorized access or information disclosure within the affected environment. There is no indication of impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor IBM's advisories for updates. In the meantime, restrict authenticated access to the IBM Instana Agent Operator and carefully control namespace permissions to limit potential exploitation.