IBM Instana Node.js tracer @instana/core 6.2.1 prototype pollution
CVE-2026-14893 Published on July 28, 2026
IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.
Vulnerability Analysis
CVE-2026-14893 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a high impact on integrity, and a small impact on availability.
Weakness Type
What is a Prototype Pollution Vulnerability?
The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CVE-2026-14893 has been classified to as a Prototype Pollution vulnerability or weakness.
Products Associated with CVE-2026-14893
Want to know whenever a new CVE is published for IBM Observability With Instana Agent? stack.watch will email you.
Affected Versions
IBM Observability with Instana (Agent):- Version Build 1.0.303, <= 1.0.320 is affected.