CVE-2026-19283: IBM Instana Agent Information Disclosure

CVE-2026-19283 Overview

CVE-2026-19283 is an authorization vulnerability in the IBM Instana Agent Operator within IBM Observability with Instana. The flaw affects Agent builds 1.0.303 through 1.0.323. The operator fails to validate the destination namespace when copying etcd mutual TLS (mTLS) client credentials from the openshift-etcd system namespace. An authenticated remote attacker with permissions to control a target namespace can trigger the operator to copy sensitive etcd client credentials into that namespace. This exposes cluster-critical credentials to unauthorized parties. The weakness is classified as [CWE-863] Incorrect Authorization.

Critical Impact
An authenticated attacker can obtain etcd mTLS client credentials, granting potential access to the OpenShift cluster's backing datastore and all secrets it contains.

Affected Products

IBM Observability with Instana (Agent) build 1.0.303
IBM Instana Agent Operator builds 1.0.303 through 1.0.323
OpenShift deployments using the affected Instana Agent Operator

Discovery Timeline

2026-09-04 - CVE-2026-19283 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-19283

Vulnerability Analysis

The IBM Instana Agent Operator manages agent deployment on OpenShift clusters. To enable etcd metrics collection, the operator copies etcd mTLS client credentials from the openshift-etcd system namespace to the namespace where the Instana Agent runs. The operator performs this copy without validating the destination namespace against an allowlist or verifying that the destination is a legitimate Instana deployment target.

An authenticated user with sufficient privileges over a namespace can influence the operator's reconciliation logic to copy the etcd client certificate and key into that attacker-controlled namespace. Because etcd stores all Kubernetes secrets, service account tokens, and cluster state, possession of etcd client credentials enables direct read access to the OpenShift control plane datastore.

The scope change reflected in the CVSS vector indicates that compromise of a single namespace impacts security controls governing the entire cluster.

Root Cause

The root cause is missing destination namespace validation in the credential-copy routine of the Instana Agent Operator. The operator trusts custom resource inputs that specify where credentials should be placed, without enforcing that the destination corresponds to a sanctioned Instana Agent namespace. This is a classic authorization boundary failure aligned with [CWE-863].

Attack Vector

Exploitation requires network access to the Kubernetes API and authenticated permissions to create or modify Instana-related custom resources in a target namespace. The attacker configures the operator to reconcile a namespace under their control. The operator then copies the etcd mTLS credentials from openshift-etcd into that namespace. The attacker retrieves the secret using standard kubectl get secret calls against their own namespace.

No user interaction is required. The vulnerability does not affect integrity or availability directly, but harvested credentials can be leveraged for follow-on attacks against etcd.

Refer to the IBM Support advisory for vendor technical details.

Detection Methods for CVE-2026-19283

Indicators of Compromise

Presence of secrets named similarly to etcd-client, etcd-metric-client, or etcd-serving-metrics in namespaces outside openshift-etcd or authorized Instana Agent namespaces.
Kubernetes audit log entries showing the Instana Agent Operator service account creating secrets in unexpected namespaces.
Custom resource modifications referencing non-standard target namespaces for the Instana Agent.

Detection Strategies

Query the Kubernetes API for secrets containing etcd client certificate material across all namespaces and flag those outside openshift-etcd.
Enable Kubernetes audit logging at the RequestResponse level for secret create and update events attributed to the Instana Agent Operator.
Compare current Instana Agent Operator versions against builds 1.0.303 through 1.0.323 and surface affected clusters.

Monitoring Recommendations

Alert on any secret copy operation whose source namespace is openshift-etcd.
Monitor for unauthorized use of etcd client certificates against the etcd API endpoints on control plane nodes.
Track creation of Instana-related custom resources in namespaces not owned by the observability team.

How to Mitigate CVE-2026-19283

Immediate Actions Required

Upgrade the IBM Instana Agent Operator to a fixed build published after 1.0.323 as directed by the IBM Support advisory.
Rotate etcd mTLS client certificates on affected OpenShift clusters to invalidate any credentials that may have been copied.
Audit all namespaces for stray etcd credential secrets and delete unauthorized copies.

Patch Information

IBM has published remediation guidance on the IBM Support Page for CVE-2026-19283. Administrators should apply the vendor-provided fixed version of the Instana Agent Operator and follow post-upgrade credential rotation instructions.

Workarounds

Restrict create and update permissions on Instana Agent custom resources to a small set of trusted service accounts via Kubernetes RBAC.
Apply an admission controller policy (for example, Kyverno or OPA Gatekeeper) that blocks the operator from creating secrets sourced from openshift-etcd in unapproved namespaces.
Temporarily disable etcd metrics collection in the Instana Agent configuration until the patched build is deployed.

bash

# Example Kyverno policy fragment restricting etcd secret placement
# Consult the IBM advisory before applying in production
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-etcd-secret-namespaces
spec:
  validationFailureAction: Enforce
  rules:
    - name: block-etcd-secret-copy
      match:
        any:
          - resources:
              kinds: ["Secret"]
      validate:
        message: "etcd client secrets may only exist in approved namespaces"
        pattern:
          metadata:
            namespace: "openshift-etcd | instana-agent"