IBM Instana Agent EUVD-2026-71272

Requires an authenticated OpenShift cluster user (or service account) with permission to create or control a namespace - this is PR:L in practice. The deployment must be IBM Observability with Instana Agent builds 1.0.303-1.0.323 running as an Operator on OpenShift (not generic Kubernetes), since the vulnerability specifically involves the openshift-etcd system namespace which is OpenShift-specific. The attacker must be able to influence the destination namespace accepted by the Operator's credential-copy routine; the exact trigger mechanism (API call, CRD creation, annotation) is not detailed in available data. Exploitation is bounded by: (1) requirement for existing cluster authentication, (2) OpenShift-only deployments, (3) attacker must have namespace creation or control privileges, (4) no UI interaction required once the namespace is positioned.

The provided CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N is well-calibrated. PR:L correctly reflects that some level of cluster authentication (ability to create or control a namespace) is required; this is not unauthenticated. S:C (scope change) captures that the confidentiality impact escapes the attacker's namespace and compromises the system namespace's credentials. C:H is justified - etcd mTLS certs are among the highest-value credentials on an OpenShift cluster. I:N and A:N are accurate; the vulnerability is purely credential exfiltration with no direct write or disruption path. Real-world risk is meaningful for organizations running Instana on OpenShift: a compromised developer or CI/CD service account with namespace-creation rights could escalate to near-total cluster read access. However, the attack surface is bounded - OpenShift-only deployments, requires some existing cluster authentication, and etcd access is typically further hardened by network policy. No public exploit code and no KEV listing reduce immediate urgency. EPSS data absent from input; the specificity of the attack path suggests targeted rather than mass exploitation.

An authenticated cluster user with the ability to create a namespace on an OpenShift cluster running a vulnerable Instana build crafts a namespace with a name or label that the Instana Agent Operator's credential-copy routine accepts as a valid destination. The Operator then copies etcd mTLS client certificates from the openshift-etcd system namespace into the attacker's namespace, where the attacker's service account can read the resulting Secret. The attacker uses those certificates to authenticate directly to the etcd API and enumerate all cluster Secrets, including service account tokens, TLS certificates, and application credentials. No public POC code has been identified.