CVE-2026-6389 HIGH

CVE-2026-6389: IBM Turbonomic Prometurbo agent used by IBM Turbonomic Application Resource Management is affected by a single vulnerability

Vendor Ibm
Product Turbonomic prometurbo agent
Weakness CWE-269
Published April 30, 2026
Last update May 1, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

IBM Turbonomic prometurbo agent 8.16.0 through 8.17.6 IBM Turbonomic Application Resource Management grants excessive cluster‑wide permissions, including unrestricted read access to all secrets. An attacker that compromises the operator or its service account can exfiltrate sensitive credentials, escalate privileges, and potentially achieve full cluster compromise.

Key dates

02Disclosure timeline

April 30, 2026 CVE published
May 1, 2026 Record updated