CVE-2023-27290
CriticalPublished
IBM Observability with Instana missing authentication
- Published
- Mar 3, 2023
- Updated
- Mar 5, 2025
- Assigning CNA
- ibm
- Evidence observed
- Apr 7, 2023
Primary CVSS
9.1/ 10Critical
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N8.6%
Low · next 30 days
- Percentile
- 94.9%
- Model date
- Sep 21, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentication. Due to this, an attacker within the network could access the datastores with read/write access. IBM X-Force ID: 248737.
Sources
1Shahid Parvez (zippon) · multiple · Apr 7, 2023
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.