IBM Instana Observability Agent Vulnerability Advisory (Multiple CVEs)

Vulnerability Overview Multiple vulnerabilities exist in the Instana Agent container image (version 1.0.321) of IBM Instana Observability, specifically including: 1. CVE-2026-8643: treats and as paths rather than file names, causing entry points to be installed outside the installation directory. 2. CVE-2026-14683: A vulnerability was detected in HdrHistogram, affecting the function, which could lead to uncontrolled memory allocation. 3. CVE-2026-14684: A vulnerability was detected in HdrHistogram, affecting the function, which could lead to uncontrolled memory allocation. 4. CVE-2026-14685: A vulnerability was detected in HdrHistogram, affecting the function, which could lead to state issues. 5. CVE-2026-14686: A vulnerability was detected in HdrHistogram, affecting the function, which could lead to incorrect comparisons. 6. CVE-2026-4519: The API accepts a leading dash in URLs, which could be used as a command-line option. 7. CVE-2026-4786: The mitigation for CVE-2026-4519 is incomplete; specific browser types may bypass the mitigation. 8. CVE-2026-6100: Use-after-free (UAF) vulnerabilities exist in , , and . 9. CVE-2026-40983: Denial of Service (DoS) may occur in Micrometer due to specially crafted gRPC requests. 10. CVE-2026-40984: Denial of Service (DoS) may occur in Micrometer due to specially crafted HTTP requests. 11. CVE-2026-25680: Parsing arbitrary HTML may consume excessive CPU time, leading to Denial of Service. 12. CVE-2026-25681: Parsing and rendering arbitrary HTML may lead to Cross-Site Scripting (XSS) attacks. 13. CVE-2026-27136: Parsing and rendering arbitrary HTML may lead to Cross-Site Scripting (XSS) attacks. 14. CVE-2026-39821: The and functions incorrectly accept Punycode-encoded labels, which may lead to privilege escalation. 15. CVE-2026-42502: Parsing and rendering arbitrary HTML may lead to Cross-Site Scripting (XSS) attacks. 16. CVE-2026-42506: Parsing and rendering arbitrary HTML may lead to Cross-Site Scripting (XSS) attacks. 17. CVE-2026-15076: Eclipse Vert.x Web Client does not validate the Domain attribute in Set-Cookie response headers, which may lead to session fixation attacks. 18. CVE-2026-14893: A prototype pollution vulnerability exists in the IBM Instana Node.js tracer component. 19. CVE-2026-31790: RSAES-PKCS1-v1_5 encapsulation may lead to the leakage of sensitive data. Scope of Impact Affected Product: IBM Observability with Instana (Agent) Affected Versions: Build 1.0.303 to 1.0.320 Operating System: Red Hat Remediation IBM strongly recommends immediately fixing these vulnerabilities by updating IBM Observability with Instana to the latest version. The specific fixed version is Build 1.0.321. Reference Links IBM Security Bulletin Additional Information CVSS Scores: CVSS scores for individual vulnerabilities range from 3.3 to 9.6. Workarounds and Mitigations: None specifically mentioned. Future Security Bulletin Notifications: Important product support alerts can be obtained by subscribing to My Notifications. Disclaimer IBM provides vulnerability scores in accordance with standards such as FIRST and CVSS but does not guarantee any express or implied merchantability or fitness for a particular purpose. Customers are responsible for assessing the impact of vulnerabilities on their own environments.

Goal Reached Thanks to every supporter — we hit 100%!

IBM Instana Observability Agent Vulnerability Advisory (Multiple CVEs)