CVE-2026-6389 - Vulnerability Analysis

Overview

IBM Turbonomic prometurbo agent 8.16.0 through 8.17.6 contains a broken access control caused by excessive cluster-wide permissions including unrestricted read access to all secrets, letting attackers with compromised operator or service account escalate privileges and exfiltrate credentials.

Severity & Score

Impact

Attackers can exfiltrate sensitive credentials, escalate privileges, and potentially fully compromise the cluster.

Mitigation

Update to a version later than 8.17.6 or the latest available version.

References

• https://www.ibm.com/support/pages/node/7270720

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner