CVE-2026-14377 · Infrastructure
NO FIX YET
The kubeturbo agent in IBM Turbonomic versions 8.16.0 through 8.21.2 has a server-side request forgery flaw. An authenticated attacker can make the system send unauthorized requests, which can enable network enumeration or further attacks.
first public Nov 8, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running the IBM Turbonomic kubeturbo agent in the 8.16.0 through 8.21.2 range are exposed, and an attacker needs valid credentials first. Environments outside that version range are not affected by this advisory.
Not affected if auth-required, version-outside-range
Who cares ibm-turbonomic, kubernetes, kubeturbo
unknown command from the sources)8.16.0 through 8.21.2No fix yet, per the sources.
IBM Turbonomic kubeturbo agent 8.16.0 through 8.21.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.