🚨 CRITICAL SECURITY: CVE-2026-19274 - RBAC Hijack Vulnerability (builds 1.0.303-1.0.323)

[jjasghar]

🚨 EMERGENCY SECURITY ADVISORY

CVE-ID: CVE-2026-19274
Severity: CRITICAL (CVSS 9.6)
Published: September 4, 2026
Affected Versions: IBM Instana Agent Operator builds 1.0.303 through 1.0.323

---

Vulnerability Summary

A critical RBAC hijack vulnerability allows authenticated Kubernetes tenants to hijack or permanently destroy another tenant's cluster-level RBAC permissions.

Technical Details

Root Cause

Cluster-scoped RBAC objects (ClusterRoleBindings) are keyed solely by bare Custom Resource (CR) name with no namespace disambiguation.

Attack Vector

1. Attacker creates a same-named InstanaAgent CR in an attacker-controlled namespace
2. This silently overwrites the shared ClusterRoleBinding used by victim agents
3. Victim agent's cluster monitoring access is revoked

Impact

• Authentication bypass: Can hijack RBAC permissions across namespaces
• Denial of Service: Can permanently destroy another tenant's cluster monitoring
• Multi-tenant isolation breach: Fundamental breakdown of namespace boundaries

Affected Components

• IBM Observability with Instana Agent Operator
• Builds: 1.0.303 through 1.0.323 (inclusive)

Recommended Actions

Immediate (for users):

1. Audit existing InstanaAgent CRs across all namespaces for duplicate names
2. Review ClusterRoleBindings created by the operator
3. Consider downgrading to versions < 1.0.303 if available (verify no other vulnerabilities)
4. Monitor for unexpected RBAC changes

For Maintainers:

• Create patch that namespace-scopes CRD references or adds namespace validation
• Add defensive checks before creating/modifying ClusterRoleBindings
• Implement proper multi-tenant isolation for cluster-scoped resources
• Release emergency patch version (1.0.324+)

References

• CVE: https://www.tenable.com/cve/CVE-2026-19274
• IBM Advisory: https://www.ibm.com/support/pages/node/7286070
• CISA Bulletin: https://www.cisa.gov/news-events/bulletins/sb26-215

---

Reported via automated security monitoring. Ready to assist with triage and fix verification.

[jjasghar]

@doertedev-instana @marcelbirkner

🚨 CRITICAL SECURITY ALERT 🚨

This is an emergency security issue for CVE-2026-19274, a critical vulnerability (CVSS 9.6) published yesterday affecting Instana Agent Operator builds 1.0.303‑1.0.323.

The vulnerability allows authenticated Kubernetes tenants to hijack or destroy another tenant's cluster-level RBAC permissions due to improper namespace disambiguation in ClusterRoleBindings.

Immediate actions needed:

1. Confirm receipt of this advisory
2. Verify the vulnerability details against your internal security team findings
3. Begin triage and patch development for builds 1.0.324+
4. Consider preparing a Security Advisory disclosure process

References:

• CVE: https://www.tenable.com/cve/CVE-2026-19274
• IBM Advisory: https://www.ibm.com/support/pages/node/7286070
• CISA Bulletin: https://www.cisa.gov/news-events/bulletins/sb26-215

This issue was created via automated security monitoring. I'm available to assist with triage, reproduction steps verification, and fix testing.

[konrad-ohms]

Hi @jjasghar,
thanks for your report.
I think you are referring to the Instana Self-hosted backend version numbers. The instana-agent-operator follows independent versioning.

We released a fix for this problem in https://github.com/instana/instana-agent-operator/releases/tag/v2.2.18 at Aug 25th.

Note: Users can deploy the instana-agent-operator v2.2.18 or instana-agent-chart v2.0.50 to existing self-hosted backends. The fix should be backwards compatilbe.

Fix PR: #565