IBM Instana Agent Operator 1.0.303-1.0.323 Remote Authenticated Data Leak
CVE-2026-19283 Published on September 4, 2026
IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system namespace into an attacker-controlled namespace.
Vulnerability Analysis
CVE-2026-19283 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVE-2026-19283 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-19283
Want to know whenever a new CVE is published for IBM Observability With Instana Agent? stack.watch will email you.
Affected Versions
IBM Observability with Instana (Agent):- Version Build 1.0.303, <= 1.0.323 is affected.