{"id":"CVE-2026-14377","kind":"vulnerability","aliases":["CVE-2026-14377"],"related":[],"title":"IBM Turbonomic kubeturbo agent: SSRF lets an attacker send requests from the host","description":"IBM Turbonomic kubeturbo agent 8.16.0 through 8.21.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.","summary":"The kubeturbo agent in IBM Turbonomic versions 8.16.0 through 8.21.2 has a server-side request forgery flaw. An authenticated attacker can make the system send unauthorized requests, which can enable network enumeration or further attacks.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-turbonomic","infrastructure","kubernetes","kubeturbo"],"not_affected_if":["auth-required","version-outside-range"],"how_to_check":"- Check the kubeturbo agent version in the Turbonomic deployment (`unknown` command from the sources)\n- Confirm whether your kubeturbo version falls within `8.16.0` through `8.21.2`","fix":null,"status":"open","published_at":"2026-11-08T18:17:01+00:00","first_seen_at":"2026-11-08T18:22:21+00:00","triaged_at":"2026-11-08T18:22:59+00:00","updated_at":"2026-11-08T18:22:59+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-08T18:22:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Turbonomic kubeturbo agent: SSRF lets an attacker send requests from the host","impact":"medium","summary":"The kubeturbo agent in IBM Turbonomic versions 8.16.0 through 8.21.2 has a server-side request forgery flaw. An authenticated attacker can make the system send unauthorized requests, which can enable network enumeration or further attacks.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-turbonomic","kubeturbo","kubernetes"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker makes the agent send requests into internal networks","analyst_note":"Confirm the fixed version and any setting from the IBM security bulletin for CVE-2026-14377; the NVD entry gives only the affected range.","how_to_check":"- Check the kubeturbo agent version in the Turbonomic deployment (`unknown` command from the sources)\n- Confirm whether your kubeturbo version falls within `8.16.0` through `8.21.2`","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range","auth-required"],"who_is_affected":"Teams running the IBM Turbonomic kubeturbo agent in the 8.16.0 through 8.21.2 range are exposed, and an attacker needs valid credentials first. Environments outside that version range are not affected by this advisory.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000735,"input_tokens":4566,"output_tokens":557,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-14377':16A,19A '-2026':15A,18A '8.16.0':33B,66C '8.21.2':35B,68C 'agent':4A,28B,65C 'allow':80C 'attack':8A,46B,61B,83C,99C 'authent':45B,82C 'cve':14A,17A 'enabl':56B 'enumer':58B,95C 'facilit':97C 'flaw':43B 'forgeri':42B,76C 'host':13A 'ibm':1A,21B,30B,62C 'ibm-turbonom':20B 'infrastructur':23B 'kubernet':24B 'kubeturbo':3A,25B,27B,64C 'lead':92C 'let':6A 'make':48B 'may':79C 'network':57B,94C 'potenti':91C 'request':10A,41B,53B,75C,87C 'send':9A,51B,85C 'server':39B,73C 'server-sid':38B,72C 'side':40B,74C 'ssrf':5A,77C 'system':50B,90C 'turbonom':2A,22B,31B,63C 'unauthor':52B,86C 'version':32B 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Teams running the IBM Turbonomic kubeturbo agent in the 8.16.0 through 8.21.2 range are exposed, and an attacker needs valid credentials first. Environments outside that version range are not affected by this advisory.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmturbonomic","infrastructure","kubernetes","kubeturbo","medium"],"campaign_type":null,"search_a":"'-14377':16A,19A '-2026':15A,18A 'agent':4A 'attack':8A 'cve':14A,17A 'host':13A 'ibm':1A 'kubeturbo':3A 'let':6A 'request':10A 'send':9A 'ssrf':5A 'turbonom':2A","search_b":"'8.16.0':33B '8.21.2':35B 'agent':28B 'attack':46B,61B 'authent':45B 'enabl':56B 'enumer':58B 'flaw':43B 'forgeri':42B 'ibm':21B,30B 'ibm-turbonom':20B 'infrastructur':23B 'kubernet':24B 'kubeturbo':25B,27B 'make':48B 'network':57B 'request':41B,53B 'send':51B 'server':39B 'server-sid':38B 'side':40B 'system':50B 'turbonom':22B,31B 'unauthor':52B 'version':32B","search_c":"'8.16.0':66C '8.21.2':68C 'agent':65C 'allow':80C 'attack':83C,99C 'authent':82C 'enumer':95C 'facilit':97C 'forgeri':76C 'ibm':62C 'kubeturbo':64C 'lead':92C 'may':79C 'network':94C 'potenti':91C 'request':75C,87C 'send':85C 'server':73C 'server-sid':72C 'side':74C 'ssrf':77C 'system':90C 'turbonom':63C 'unauthor':86C 'vulner':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-14377","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14377","severity":null,"published_at":"2026-11-08T18:17:01+00:00","modified_at":"2026-11-08T18:17:01+00:00","first_seen_at":"2026-11-08T18:22:21+00:00","fetched_at":"2026-11-08T18:22:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}