The vulnerability is caused by IBM Turbonomic kubeturbo agent's failure to validate or incorrectly validating TLS certificates, which allows an attacker positioned between the client and the backend service to perform a man‑in‑the‑middle attack and intercept or tamper with sensitive data. This flaw is a classic certificate validation weakness (CWE‑295) and directly compromises confidentiality.

IBM Turbonomic kubeturbo agent versions 8.16.0 through 8.20.3 are affected. The patched release is 8.20.4, which restores proper TLS certificate validation.

The CVSS score of 5.9 indicates moderate severity, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires the attacker to be able to intercept traffic to the kubeturbo agent, typically by acting as an intermediary or by presenting a rogue certificate to the agent. Because the exploitation surface is network‑based and relies on interception of TLS traffic, the likelihood of attack is dependent on the attacker’s ability to position themselves in the network path and bypass or misconfigure certificate validation. The EPSS score is not available, so no additional exploitation probability is reported. Overall, the risk is moderate with a realistic threat for targeted or privileged attackers.