Information Disclosure Vulnerability in IBM Instana Agent Operator

IBM Observability with Instana (Agent) versions 1.0.303 through 1.0.323 are affected by a security vulnerability within the Instana Agent Operator. The flaw stems from a lack of destination namespace validation when the operator performs secret synchronization operations. Specifically, the operator is susceptible to copying etcd mTLS client credentials from the protected 'openshift-etcd' system namespace into an arbitrary namespace controlled by an authenticated user. This exposure of sensitive security credentials facilitates unauthorized access to the cluster's etcd database. An attacker with sufficient privileges to interact with the Operator could potentially escalate their access or gain administrative control over the cluster by leveraging these credentials to bypass authentication and authorization controls within the Kubernetes environment.

Impact

Successful exploitation results in the unauthorized disclosure of sensitive etcd mTLS credentials. This could lead to full cluster compromise as etcd holds the state and configuration of the entire OpenShift/Kubernetes environment.

Recommendation

• Identify all instances of IBM Observability with Instana (Agent) versions 1.0.303 through 1.0.323 currently deployed in the environment.
• Upgrade the Instana Agent Operator to the remediated version provided by IBM to resolve the namespace validation flaw associated with CVE-2026-19283.
• Review Kubernetes Role-Based Access Control (RBAC) configurations for the Instana Agent Operator to ensure it operates with the principle of least privilege, specifically restricting its ability to access secrets in the 'openshift-etcd' namespace.
• Audit logs for unauthorized access or unexpected secret synchronization activity involving the Instana Agent Operator service account.