Description

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR name with no namespace disambiguation, allowing a same-named `InstanaAgent` CR in an attacker-controlled namespace to silently overwrite the shared `ClusterRoleBinding` or delete it outright and revoke the victim agent's cluster monitoring access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-09-04T16:17:21.650Z",
  "pubdate": "2026-09-04T16:17:21.650Z",
  "executiveSummary": "A critical privilege escalation and resource manipulation vulnerability exists in the IBM Instana Agent Operator, affecting versions 1.0.303 through 1.0.323.\nThe vulnerability stems from improper scoping of cluster-level RBAC objects, which are keyed solely by the Custom Resource (CR) name without namespace disambiguation.\nThis flaw allows an authenticated Kubernetes tenant with permissions to create an InstanaAgent CR to manipulate or destroy ClusterRoleBindings associated with other tenants or the global agent installation.\nAn attacker can exploit this to hijack monitoring permissions, revoke the access of legitimate agents, or perform a denial-of-service on cluster observability functions.\nThe risk is categorized as high due to the potential for cross-tenant impact and the ability to interfere with cluster-level security configurations.\nSuccessful exploitation requires the attacker to have existing, although potentially limited, namespace-level access to deploy an InstanaAgent resource with a colliding name.",
  "technicalDetails": "The root cause of this vulnerability is a namespace isolation failure within the IBM Instana Agent Operator’s control logic. Specifically, the operator reconciles InstanaAgent CRs by managing associated ClusterRoleBindings using the CR name as the primary identifier.\nIn a multi-tenant Kubernetes environment, the operator fails to implement namespace-based disambiguation for these global RBAC objects. Because ClusterRoleBindings are cluster-scoped, the operator inadvertently treats all InstanaAgent CRs named identically—regardless of the namespace in which they originate—as the same entity.\nThe attack flow proceeds as follows: An authenticated tenant identifying a target InstanaAgent CR name (e.g., 'instana-agent') in a different namespace creates a new InstanaAgent CR with the same name in their own attacker-controlled namespace. Upon reconciliation, the operator's controller attempts to synchronize the state of the associated ClusterRoleBinding.\nBecause the controller logic lacks proper ownership validation or namespace scoping, the attacker's CR forces the controller to overwrite the pre-existing ClusterRoleBinding. This allows the attacker to redefine the permissions associated with the ClusterRoleBinding, effectively hijacking the monitoring privileges previously held by the victim's agent instance.\nAlternatively, the attacker can delete their malicious CR after triggering the overwrite or manipulate the controller into removing the binding entirely, resulting in a denial-of-service where the victim agent loses its cluster monitoring capabilities.\nThis vulnerability is particularly dangerous because the operator performs these operations with elevated cluster-level privileges, effectively turning the operator into a confused deputy. An attacker does not require cluster-admin privileges to initiate the attack; they only require the capability to create InstanaAgent CRs within a namespace where the operator is active.\nThe post-exploitation impact includes unauthorized data access, the ability to mask malicious activity by disabling monitoring, and the potential for privilege escalation by binding excessive permissions to the agent's ServiceAccount."
}