Search
Find a vulnerability
Search criteria
2 vulnerabilities found for Observability with Instana (Agent) by IBM
CVE-2026-14893 (GCVE-0-2026-14893)
Vulnerability from nvd – Published: 2026-07-28 20:36 – Updated: 2026-07-29 14:10
VLAI
EPSS
VEX
Title
IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image
Summary
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-29 14:10 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7281349 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Observability with Instana (Agent) |
Affected:
Build 1.0.303 , ≤ 1.0.320
(semver)
cpe:2.3:a:ibm:observability_with_instana_agent:build:*:*:*:*:*:*:* cpe:2.3:a:ibm:observability_with_instana_agent:1.0.320:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14893",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T14:10:32.479606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T14:10:41.839Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:observability_with_instana_agent:build:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:observability_with_instana_agent:1.0.320:*:*:*:*:*:*:*"
],
"product": "Observability with Instana (Agent)",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "1.0.320",
"status": "affected",
"version": "Build 1.0.303",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.\u003c/p\u003e"
}
],
"value": "IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T20:36:57.507Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7281349"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing these vulnerabilities now by updating IBM Observability with Instana to the latest release as described here:\u003c/p\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/docs/en/instana-observability?topic=agents-updating-host\" rel=\"nofollow\"\u003ehttps://www.ibm.com/docs/en/instana-observability?topic=agents-updating-host\u003c/a\u003e\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eAffected Product(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fixes/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Observability with Instana (Agent)\u003c/td\u003e\u003ctd\u003eBuild 1.0.303 to 1.0.320\u003c/td\u003e\u003ctd\u003eBuild 1.0.321\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "IBM strongly recommends addressing these vulnerabilities now by updating IBM Observability with Instana to the latest release as described here:\n\n\n\n https://www.ibm.com/docs/en/instana-observability?topic=agents-updating-host \n\nAffected Product(s)Version(s)Remediation/Fixes/InstructionsIBM Observability with Instana (Agent)Build 1.0.303 to 1.0.320Build 1.0.321"
}
],
"title": "IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image",
"x_generator": {
"engine": "ibm-cvegen"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-14893",
"datePublished": "2026-07-28T20:36:57.507Z",
"dateReserved": "2026-07-06T18:19:15.930Z",
"dateUpdated": "2026-07-29T14:10:41.839Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14893 (GCVE-0-2026-14893)
Vulnerability from cvelistv5 – Published: 2026-07-28 20:36 – Updated: 2026-07-29 14:10
VLAI
EPSS
VEX
Title
IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image
Summary
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-29 14:10 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.ibm.com/support/pages/node/7281349 | vendor-advisorypatch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| IBM | Observability with Instana (Agent) |
Affected:
Build 1.0.303 , ≤ 1.0.320
(semver)
cpe:2.3:a:ibm:observability_with_instana_agent:build:*:*:*:*:*:*:* cpe:2.3:a:ibm:observability_with_instana_agent:1.0.320:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14893",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T14:10:32.479606Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T14:10:41.839Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ibm:observability_with_instana_agent:build:*:*:*:*:*:*:*",
"cpe:2.3:a:ibm:observability_with_instana_agent:1.0.320:*:*:*:*:*:*:*"
],
"product": "Observability with Instana (Agent)",
"vendor": "IBM",
"versions": [
{
"lessThanOrEqual": "1.0.320",
"status": "affected",
"version": "Build 1.0.303",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.\u003c/p\u003e"
}
],
"value": "IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T20:36:57.507Z",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://www.ibm.com/support/pages/node/7281349"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIBM strongly recommends addressing these vulnerabilities now by updating IBM Observability with Instana to the latest release as described here:\u003c/p\u003e\u003cp\u003e\u003ca href=\"https://www.ibm.com/docs/en/instana-observability?topic=agents-updating-host\" rel=\"nofollow\"\u003ehttps://www.ibm.com/docs/en/instana-observability?topic=agents-updating-host\u003c/a\u003e\u003c/p\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003ctable\u003e\u003ccolgroup\u003e\u003ccol/\u003e\u003ccol/\u003e\u003ccol/\u003e\u003c/colgroup\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eAffected Product(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fixes/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Observability with Instana (Agent)\u003c/td\u003e\u003ctd\u003eBuild 1.0.303 to 1.0.320\u003c/td\u003e\u003ctd\u003eBuild 1.0.321\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "IBM strongly recommends addressing these vulnerabilities now by updating IBM Observability with Instana to the latest release as described here:\n\n\n\n https://www.ibm.com/docs/en/instana-observability?topic=agents-updating-host \n\nAffected Product(s)Version(s)Remediation/Fixes/InstructionsIBM Observability with Instana (Agent)Build 1.0.303 to 1.0.320Build 1.0.321"
}
],
"title": "IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image",
"x_generator": {
"engine": "ibm-cvegen"
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2026-14893",
"datePublished": "2026-07-28T20:36:57.507Z",
"dateReserved": "2026-07-06T18:19:15.930Z",
"dateUpdated": "2026-07-29T14:10:41.839Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}