{"id":"CVE-2026-14434","kind":"vulnerability","aliases":["CVE-2026-14434"],"related":[],"title":"IBM Turbonomic kubeturbo: TLS certificate checks let attackers intercept data","description":"IBM Turbonomic kubeturbo agent 8.16.0 through 8.21.2 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.","summary":"The kubeturbo agent in IBM Turbonomic versions 8.16.0 through 8.21.2 does not properly validate TLS certificates. A machine-in-the-middle attacker on the network path can obtain sensitive information from the agent's connections.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-turbonomic","infrastructure","kubernetes","kubeturbo"],"not_affected_if":["version-outside-8.16.0-to-8.21.2"],"how_to_check":"- Check the kubeturbo agent version in the Turbonomic deployment, for example `kubectl get deployment kubeturbo -n turbonomic -o jsonpath='{.spec.template.spec.containers[0].image}'` (namespace and deployment name may differ)","fix":null,"status":"open","published_at":"2026-11-08T18:17:01+00:00","first_seen_at":"2026-11-08T18:22:21+00:00","triaged_at":"2026-11-08T18:22:53+00:00","updated_at":"2026-11-08T18:22:53+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-08T18:22:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Turbonomic kubeturbo: TLS certificate checks let attackers intercept data","impact":"medium","summary":"The kubeturbo agent in IBM Turbonomic versions 8.16.0 through 8.21.2 does not properly validate TLS certificates. A machine-in-the-middle attacker on the network path can obtain sensitive information from the agent's connections.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-turbonomic","kubeturbo","kubernetes"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"sensitive data sent by the agent is readable by a network attacker","analyst_note":"Find the IBM security bulletin for CVE-2026-14434 to confirm the fixed version and which connections lack certificate validation.","how_to_check":"- Check the kubeturbo agent version in the Turbonomic deployment, for example `kubectl get deployment kubeturbo -n turbonomic -o jsonpath='{.spec.template.spec.containers[0].image}'` (namespace and deployment name may differ)\n- unknown for other checks: the sources do not say what configuration makes the agent exposed","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-8.16.0-to-8.21.2"],"who_is_affected":"Teams running IBM Turbonomic with the kubeturbo agent in versions 8.16.0 through 8.21.2 are exposed. An attacker must sit on the network path between the agent and the server it talks to. The sources do not say which connections are affected, so teams on other versions can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000766,"input_tokens":4543,"output_tokens":623,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-14434':13A,16A '-2026':12A,15A '8.16.0':30B,63C '8.21.2':32B,65C 'agent':25B,56B,62C 'allow':77C 'attack':8A,45B,79C 'certif':5A,38B,73C 'check':6A 'connect':58B 'could':76C 'cve':11A,14A 'data':10A 'ibm':1A,18B,27B,59C 'ibm-turbonom':17B 'improp':70C 'inform':53B,83C 'infrastructur':20B 'intercept':9A 'kubernet':21B 'kubeturbo':3A,22B,24B,61C 'let':7A 'machin':41B 'machine-in-the-middl':40B 'man':85C 'middl':44B,88C 'network':48B 'obtain':51B,81C 'path':49B 'proper':35B 'sensit':52B,82C 'techniqu':89C 'tls':4A,37B,72C 'turbonom':2A,19B,28B,60C 'use':84C 'valid':36B,68C,71C,74C 'version':29B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Turbonomic with the kubeturbo agent in versions 8.16.0 through 8.21.2 are exposed. An attacker must sit on the network path between the agent and the server it talks to. The sources do not say which connections are affected, so teams on other versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmturbonomic","infrastructure","kubernetes","kubeturbo","medium"],"campaign_type":null,"search_a":"'-14434':13A,16A '-2026':12A,15A 'attack':8A 'certif':5A 'check':6A 'cve':11A,14A 'data':10A 'ibm':1A 'intercept':9A 'kubeturbo':3A 'let':7A 'tls':4A 'turbonom':2A","search_b":"'8.16.0':30B '8.21.2':32B 'agent':25B,56B 'attack':45B 'certif':38B 'connect':58B 'ibm':18B,27B 'ibm-turbonom':17B 'inform':53B 'infrastructur':20B 'kubernet':21B 'kubeturbo':22B,24B 'machin':41B 'machine-in-the-middl':40B 'middl':44B 'network':48B 'obtain':51B 'path':49B 'proper':35B 'sensit':52B 'tls':37B 'turbonom':19B,28B 'valid':36B 'version':29B","search_c":"'8.16.0':63C '8.21.2':65C 'agent':62C 'allow':77C 'attack':79C 'certif':73C 'could':76C 'ibm':59C 'improp':70C 'inform':83C 'kubeturbo':61C 'man':85C 'middl':88C 'obtain':81C 'sensit':82C 'techniqu':89C 'tls':72C 'turbonom':60C 'use':84C 'valid':68C,71C,74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-14434","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14434","severity":null,"published_at":"2026-11-08T18:17:01+00:00","modified_at":"2026-11-08T18:17:01+00:00","first_seen_at":"2026-11-08T18:22:21+00:00","fetched_at":"2026-11-08T18:22:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}