CVE-2026-19274

CVE-2026-19274 is an improper access-control flaw (CWE-284) in the IBM Instana Agent Operator shipped with Observability with Instana agent builds 1.0.303 through 1.0.323, in which cluster-scoped RBAC objects such as the shared ClusterRoleBinding are keyed only by the bare custom-resource name with no namespace disambiguation. An authenticated tenant on a shared Kubernetes cluster can trigger it simply by creating an InstanaAgent custom resource with the same name in a namespace they control, causing the operator to treat it as the same cluster-level object. The attacker can then silently overwrite or permanently delete another tenant's ClusterRoleBinding, hijacking or revoking the victim agent's cluster monitoring permissions (high integrity and availability impact, no confidentiality impact). Any organization running affected agent builds on multi-tenant Kubernetes clusters is affected, with risk concentrated where multiple tenants share one cluster. No public proof-of-concept, KEV listing, or in-the-wild exploitation is known; EPSS estimates roughly a 0.2% probability of exploitation within 30 days.

What to do: Upgrade the Instana Agent Operator to a build newer than 1.0.323 per IBM's security bulletin, since the stated affected range ends at 1.0.323. Until patched, restrict which namespaces and service accounts can create InstanaAgent custom resources, and review Kubernetes API audit logs for unexpected creation, modification, or deletion of the shared Instana ClusterRoleBinding to detect prior tenant tampering.