CVE-2026-19283CWE-863broken-access-control

CVE-2026-19283

High · published September 4, 2026

CVSS v3.1
7.7
EPSS
0%
Percentile
22.3
In the wild
Unconfirmed
What it is

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system namespace into an attacker-controlled namespace.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00307 · 22.3th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-04T20:17Z
References (1)
https://www.ibm.com/support/pages/node/7286070 · [email protected]
EPSS history
Timeline
  • 06 SEP 03:30Z
    EPSS moved — → 0%
    epss
  • 04 SEP 15:49Z
    IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image
    cvelistv5