IBM Instana Agent Operator: a same-named CR in any namespace overwrites or deletes the shared ClusterRoleBinding

Impact

The operator names its cluster-scoped RBAC objects after the bare CR name with no namespace component, so an InstanaAgent CR created in any namespace collides with the one a cluster admin deployed. A tenant who can create that CR in a namespace they already control can silently rewrite the shared ClusterRoleBinding to point at a subject of their choosing, or delete it and cut the legitimate agent off from cluster monitoring. On a shared GPU cluster this is both an escalation path and a blinding move: the binding is cluster-wide, so whatever permissions the monitoring agent holds across every namespace become reachable, and the operator that would fix it is the same one being abused. The vendor scores it 9.6 with a changed scope, which matches the cross-tenant reach.

Who can reach it

Any authenticated Kubernetes user who can create an InstanaAgent custom resource in a namespace they control. Namespace-scoped tenant rights are enough; no node access, no cluster-admin, and no position on the management network beyond ordinary API server access.

What to do

Affected builds are 1.0.303 through 1.0.323; the record does not name a fixed build, so take the version from IBM support node 7286070 before scheduling anything. The rollout itself is cheap: bump the operator image and let the operator Deployment restart, with no impact on GPU workloads or node uptime. Afterwards, audit existing cluster-scoped RBAC objects the operator owns for bindings whose subjects you did not create, and re-apply the intended ClusterRoleBinding if a tenant already overwrote it. Until you patch, restrict who can create InstanaAgent CRs, since that permission is the whole attack.

References

Related entries

• Kata Containers: kata-runtime host code execution via an untrusted input pathCVE-2026-50540 · Kata ContainersCritical
• Kyverno: namespaced mutating policy can generate resources into any namespaceCVE-2026-54523 · Kyverno admission controller (NamespacedMutatingPolicy CEL generator library)Critical
• RHACM GitOpsCluster: tenant can redirect spoke cluster bearer tokens into a namespace they controlCVE-2026-70398 · Red Hat Advanced Cluster Management - multicloud-integrations (GitOpsCluster controller)Critical
• Rancher: SAML assertion replay: the ACS handler does not enforce one-time use, so a captured assertion logsCVE-2026-44946 · RancherCritical
• Harbor: Hard-coded default credentials give web UI access to the whole registryCVE-2026-4404 · HarborCritical
• containerd: CRI plugin propagates unvalidated image LABEL values into container configCVE-2026-53488 · containerdCritical