Kubernetes RBAC Vulnerability in IBM Observability with Instana

CVE-2026-19274

What is CVE-2026-19274?

A security vulnerability in IBM Observability with Instana allows an authenticated Kubernetes tenant to hijack or destructively overwrite another tenant's cluster-level Role-Based Access Control (RBAC) permissions. This issue arises from the reliance on cluster-scoped RBAC objects being identified only by their bare Custom Resource (CR) name, without considering namespace differentiation. This flaw permits an attacker to create a similarly named InstanaAgent CR within their own, unauthorized namespace, which can then overwrite the existing ClusterRoleBinding, leading to the potential revocation of cluster monitoring access for the victim, thereby compromising their operational integrity.

References