Description
IBM Turbonomic kubeturbo agent 8.16.0 through 8.21.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Published: 2026-11-08
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: Server‑Side Request Forgery that can allow an authenticated attacker to send arbitrary requests from the system, exposing internal network resources or facilitating further attacks
Action: Patch now
AI Analysis

Impact

IBM Turbonomic kubeturbo agent versions 8.16.0 through 8.21.2 contain a server‑side request forgery flaw. An attacker with valid credentials to the agent can request arbitrary URLs using the agent’s outbound network stack. This can result in network reconnaissance, access to internal services that are otherwise protected, and can be a stepping stone to more serious compromises. The vulnerability is a classic SSRF with potential to disrupt confidentiality, integrity, or availability of internal components.

Affected Systems

The affected product is IBM Turbonomic kubeturbo agent, specifically versions starting from 8.16.0 up to and including 8.21.2. The fix is incorporated in version 8.21.3 and later. IBM recommends reinstalling the agent with the updated image that includes the required SSRF patch.

Risk and Exploitability

The CVSS score of 5.4 indicates a moderate risk, with the potential for attacker‑controlled outbound traffic. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector requires an authenticated user that can interact with the kubeturbo service, making this a moderate‑severity and moderately exploitable risk in environments where the agent is exposed to untrusted input.

Generated by OpenCVE AI on November 8, 2026 at 18:23 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by re-installing a version of kubeturbo with the required fix. Product(s)Version(s) number and/or range Remediation/Fix/InstructionsIBM Turbonomic kubeturbo agent8.21.3 kubeturbo installation instructions https://www.ibm.com/docs/en/tarm/8.20.4

OpenCVE Recommended Actions

  • Upgrade the IBM Turbonomic kubeturbo agent to version 8.21.3 or later using IBM’s installation instructions to apply the SSRF fix.
  • Limit the agent’s outbound connections by applying Kubernetes Network Policies or firewall rules that only allow traffic to approved destinations.
  • Enforce strict authentication and role‑based access controls on the kubeturbo service so that only trusted users can invoke API endpoints that may trigger external requests.

Generated by OpenCVE AI on November 8, 2026 at 18:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 08 Nov 2026 18:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-918

Sun, 08 Nov 2026 17:30:00 +0000

Type Values Removed Values Added
Description IBM Turbonomic kubeturbo agent 8.16.0 through 8.21.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
Title IBM Turbonomic kubeturbo agent, used by IBM Turbonomic Application Resource Management, is affected by a security vulnerability
First Time appeared Ibm
Ibm turbonomic Kubeturbo Agent
CPEs cpe:2.3:a:ibm:turbonomic_kubeturbo_agent:8.16.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:turbonomic_kubeturbo_agent:8.21.2:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm turbonomic Kubeturbo Agent
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Ibm Turbonomic Kubeturbo Agent
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-11-08T17:20:54.342Z

Reserved: 2026-07-01T20:33:35.197Z

Link: CVE-2026-14377

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-08T18:17:01.590

Modified: 2026-11-08T18:17:01.693

Link: CVE-2026-14377

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-08T18:30:11Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)