IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions, caused by cluster-scoped RBAC objects being keyed solely by the bare CR name with no namespace disambiguation, allowing a same-named `InstanaAgent` CR in an attacker-controlled namespace to silently overwrite the shared `ClusterRoleBinding` or delete it outright and revoke the victim agent's cluster monitoring access.

CVE-2026-19274 affects IBM Observability with Instana Agent builds 1.0.303 through 1.0.323. The vulnerability resides in the IBM Instana Agent Operator and allows an authenticated Kubernetes tenant to hijack or permanently destroy another tenant's cluster-level RBAC permissions. The root cause is that cluster-scoped RBAC objects are keyed solely by the bare Custom Resource (CR) name without namespace disambiguation. An attacker can deploy a same-named InstanaAgent CR in an attacker-controlled namespace to silently overwrite the shared ClusterRoleBinding or delete it entirely. This effectively revokes the victim agent's cluster monitoring access. The vulnerability requires authentication but can be exploited by any tenant in a multi-tenant Kubernetes environment. IBM has published an advisory at their support pages addressing this issue.