PT-2026-36199 · Ibm · Turbonomic Prometurbo Agent

Lior Yakim · Published 2026-04-30 · Updated 2026-05-05 · CVE-2026-6389

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Turbonomic prometurbo agent versions 8.16.0 through 8.17.6

Description IBM Turbonomic Application Resource Management grants excessive cluster-wide permissions, which include unrestricted read access to all secrets. An attacker who compromises the operator or its service account can exfiltrate sensitive credentials, escalate privileges, and potentially achieve full cluster compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-6389

Affected Products

Turbonomic Prometurbo Agent

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-6389 · Security Note
• https://twitter.com/vuldb/status/2050163860381065422 · Twitter Post
• https://t.me/cveNotify/162104 · Telegram Post
• https://twitter.com/KaitanSecurity/status/2049979628773613679 · Twitter Post
• https://twitter.com/CVEnew/status/2049970626396664029 · Twitter Post
• https://t.me/CVEtracker/52359 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2049990148146724940 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1t0sv0a/critical_permissions_flaw_in_ibm_turbonomic · Reddit Post
• https://ibm.com/support/pages/node/7270720 · Patch, Vendor Advisory