EUVD-2026-71272
GHSA-j3vm-fghw-9vpj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
PR:L required for existing cluster authentication and namespace control; S:C and C:H reflect cross-namespace credential exfiltration reaching etcd; I:N and A:N as impact is read-only credential theft.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
3DescriptionCVE.org
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system namespace into an attacker-controlled namespace.
AnalysisAI
IBM Instana Agent Operator on OpenShift exposes etcd mTLS client credentials to authenticated cluster users via missing namespace destination validation. Builds 1.0.303 through 1.0.323 of IBM Observability with Instana allow a low-privileged authenticated attacker who controls a Kubernetes namespace to redirect the operator's credential-copy routine - intended to distribute etcd mTLS client certs within Instana-managed namespaces - into their own attacker-controlled namespace. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated OpenShift cluster user (or service account) with permission to create or control a namespace - this is PR:L in practice. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N is well-calibrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade IBM Instana Agent to the build identified as fixed in IBM Security Bulletin https://www.ibm.com/support/pages/node/7286070 - the exact patched build number is not specified in available input data and must be confirmed from the advisory directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, complete an audit of all OpenShift and Kubernetes environments to identify any deployments running IBM Observability with Instana Agent Operator in builds 1.0.303 through 1.0.323, focusing first on production systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-tenant RBAC hijacking in IBM Observability with Instana Agent Operator (Builds 1.0.303-1.0.323) lets an authentica
Prototype pollution in the @instana/core Node.js tracer, part of IBM Observability with Instana Agent builds 1.0.303 to
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today