A critical vulnerability in the IBM Observability with Instana Agent allows authenticated users to manipulate or delete cluster-wide RBAC configurations, leading to unauthorized control or denial of service.

This vulnerability involves improper access control (CWE-284) where cluster-scoped RBAC objects are keyed solely by the Custom Resource name without namespace disambiguation. An authenticated Kubernetes tenant can exploit this to overwrite or delete shared ClusterRoleBinding objects belonging to other tenants.

The ability to hijack or destroy RBAC permissions poses a severe threat to the integrity and availability of the entire Kubernetes cluster environment. With a CVSS score of 9.6, this flaw permits an attacker to effectively escalate privileges or perform a denial of service against monitoring operations, potentially leading to significant operational disruption and loss of visibility into critical infrastructure.

Immediate Action: Update the IBM Observability with Instana (Agent) to Build 1.0.324 or later as recommended by the vendor.

Proactive Monitoring: Review Kubernetes audit logs for suspicious activity involving ClusterRoleBinding modifications or unexpected deletions of RBAC objects associated with the Instana Agent.

Compensating Controls: Implement strict Kubernetes Namespace isolation and RBAC policies to limit the potential impact of a compromised tenant account while the update is being staged.

Public Exploit Available: No (exploit_available: false)

Given the critical CVSS severity and the potential for total loss of RBAC integrity within the cluster, immediate patching is required. Administrators should prioritize the deployment of Build 1.0.324 across all affected Kubernetes environments to eliminate the risk of cross-tenant interference and unauthorized privilege escalation.