CVE-2026-14893 - Vulnerability Details - OpenCVE

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00334.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ibm	Observability With Instana Agent

No data.

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7281349

History

Wed, 29 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 28 Jul 2026 21:00:00 +0000

Type	Values Removed	Values Added
Description		IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.
Title		IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image
First Time appeared		Ibm Ibm observability With Instana Agent
Weaknesses		CWE-1321
CPEs		cpe:2.3:a:ibm:observability_with_instana_agent:1.0.320:::::::* cpe:2.3:a:ibm:observability_with_instana_agent:build:::::::*
Vendors & Products		Ibm Ibm observability With Instana Agent
References		https://www.ibm.com/support/pages/node/7281349
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2026-07-28T20:36:57.507Z

Updated: 2026-07-29T14:10:41.839Z

Reserved: 2026-07-06T18:19:15.930Z

Link: CVE-2026-14893

Vulnrichment

Updated: 2026-07-29T14:10:38.079Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14893", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-07-06T18:19:15.930Z", "datePublished": "2026-07-28T20:36:57.507Z", "dateUpdated": "2026-07-29T14:10:41.839Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-07-28T20:36:57.507Z"}, "title": "IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1321", "description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "Observability with Instana (Agent)", "versions": [{"status": "affected", "version": "Build 1.0.303", "lessThanOrEqual": "1.0.320", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:observability_with_instana_agent:build:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:observability_with_instana_agent:1.0.320:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.</p>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7281349", "tags": ["vendor-advisory", "patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "baseSeverity": "HIGH", "baseScore": 7.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"}}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing these vulnerabilities now by updating IBM Observability with Instana to the latest release as described here:\n\n\n\n https://www.ibm.com/docs/en/instana-observability?topic=agents-updating-host \n\nAffected Product(s)Version(s)Remediation/Fixes/InstructionsIBM Observability with Instana (Agent)Build 1.0.303 to 1.0.320Build 1.0.321", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM strongly recommends addressing these vulnerabilities now by updating IBM Observability with Instana to the latest release as described here:</p><p><a href=\"https://www.ibm.com/docs/en/instana-observability?topic=agents-updating-host\" rel=\"nofollow\">https://www.ibm.com/docs/en/instana-observability?topic=agents-updating-host</a></p><div><div><div><table><colgroup><col/><col/><col/></colgroup><tbody><tr><td><strong>Affected Product(s)</strong></td><td><strong>Version(s)</strong></td><td><strong>Remediation/Fixes/Instructions</strong></td></tr><tr><td>IBM Observability with Instana (Agent)</td><td>Build 1.0.303 to 1.0.320</td><td>Build 1.0.321</td></tr></tbody></table></div></div></div>"}]}], "x_generator": {"engine": "ibm-cvegen"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T14:10:32.479606Z", "id": "CVE-2026-14893", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T14:10:41.839Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-14893", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-29T14:10:32.479606Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T14:10:38.079Z"}}], "cna": {"title": "IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.3, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:observability_with_instana_agent:build:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:observability_with_instana_agent:1.0.320:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Observability with Instana (Agent)", "versions": [{"status": "affected", "version": "Build 1.0.303", "versionType": "semver", "lessThanOrEqual": "1.0.320"}]}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing these vulnerabilities now by updating IBM Observability with Instana to the latest release as described here:\n\n\n\n https://www.ibm.com/docs/en/instana-observability?topic=agents-updating-host \n\nAffected Product(s)Version(s)Remediation/Fixes/InstructionsIBM Observability with Instana (Agent)Build 1.0.303 to 1.0.320Build 1.0.321", "supportingMedia": [{"type": "text/html", "value": "<p>IBM strongly recommends addressing these vulnerabilities now by updating IBM Observability with Instana to the latest release as described here:</p><p><a href=\"https://www.ibm.com/docs/en/instana-observability?topic=agents-updating-host\" rel=\"nofollow\">https://www.ibm.com/docs/en/instana-observability?topic=agents-updating-host</a></p><div><div><div><table><colgroup><col/><col/><col/></colgroup><tbody><tr><td><strong>Affected Product(s)</strong></td><td><strong>Version(s)</strong></td><td><strong>Remediation/Fixes/Instructions</strong></td></tr><tr><td>IBM Observability with Instana (Agent)</td><td>Build 1.0.303 to 1.0.320</td><td>Build 1.0.321</td></tr></tbody></table></div></div></div>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7281349", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-07-28T20:36:57.507Z"}}}, "cveMetadata": {"cveId": "CVE-2026-14893", "state": "PUBLISHED", "dateUpdated": "2026-07-29T14:10:41.839Z", "dateReserved": "2026-07-06T18:19:15.930Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-07-28T20:36:57.507Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}