Vulnerability details

CVE-2026-14893

IBM Observability with Instana

IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image

CVSS 3.1

7.3High

Official description

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.

CVSS scores

Score	Version	Source	Vector
7.3High	3.1	CVEProject cvelistV5 (CNA) (ibm)	`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L`

Affected products

Vendor	Product	Versions	Source
IBM	Observability with Instana (Agent)	Build 1.0.303 ≤ v ≤ 1.0.320	CVEProject cvelistV5 (CNA)

References and advisories

https://www.ibm.com/support/pages/node/7281349 vendor-advisorypatch

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-29
Last updated: 2026-07-29
State: Published
Assigner (CNA): ibm

Exploit prediction (EPSS)

0.33%

Probability of exploitation in 30 days

26.9%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')