TI-2023-12028 Aliases CVE-2023-27290 GHSA-g98m-73rh-c5j6

IBM Observability with Instana missing authentication

HIGH 78CWE-306Published 2023-03-03 · Updated 2025-03-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentication. Due to this, an attacker within the network could access the datastores with read/write access. IBM X-Force ID: 248737.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.08573 95th percentileScored 2026-11-07

Fix Fixed Observability with Instana (IBM): 239-2, 241-2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IBM	Observability with Instana	239-0 to before 239-2; 241-0 to before 241-2; 243-0	239-2, 241-2	Patch available	CNA

Observability with Instana VendorIBM Affected 239-0 to before 239-2; 241-0 to before 241-2; 243-0 Fixed in 239-2, 241-2 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:ibm:observability_with_instana::::::::	239-0 – 239-2; 241-0 – 241-2	Vulnerable	IBM
cpe:2.3:a:ibm:observability_with_instana:243-0:::::::*	243-0	Vulnerable	IBM

cpe:2.3:a:ibm:observability_with_instana:*:*:*:*:*:*:*:* Versions 239-0 – 239-2; 241-0 – 241-2 Vulnerable ·IBM
cpe:2.3:a:ibm:observability_with_instana:243-0:*:*:*:*:*:*:* Versions 243-0 Vulnerable ·IBM

Remediation

Fix · CNA Observability with Instana (IBM) Fixed in 239-2, 241-2

Timeline

2026-10-02 Threatist record created from CVE-2023-27290
2026-10-03 Alias added: GHSA-g98m-73rh-c5j6
2026-10-14 EPSS moved to the 95th–99th percentile

References

Advisory 1

https://www.ibm.com/support/pages/node/6959969

Other 1

http://packetstormsecurity.com/files/171770/IBM-Instana-243-0-Missing-Authentication.html

TI-2023-19022 IBM Observability with Instana code execution CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences