The vulnerability exists in IBM Turbonomic kubeturbo agent versions 8.16.0 to 8.21.2, where TLS certificate validation is either missing or improperly performed. This flaw may enable an attacker to intercept and read traffic between the agent and its target systems, leading to the disclosure of sensitive data. The weakness is a classic certificate validation bypass and is identified as CWE-295.

Affected systems are IBM Turbonomic kubeturbo agent deployments running versions from 8.16.0 up through 8.21.2. The product is used within IBM Turbonomic Application Resource Management solutions that manage Kubernetes resources. The most recent fixed version is 8.21.3, as documented in IBM’s release notes and installation instructions.

The CVSS score of 5.9 indicates moderate severity. No EPSS score is available, so the current likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker positioning themselves as a man‑in‑the‑middle on the network path between the agent and its service endpoint; with network access and a suitable MITM capability, they could read otherwise encrypted traffic. Because the flaw does not provide remote code execution, impact is limited to information disclosure.