---
id: "CVE-2026-14434"
page: "https://infrastack.ai/live/CVE-2026-14434"
kind: "vulnerability"
aliases: ["CVE-2026-14434"]
title: "IBM Turbonomic kubeturbo: TLS certificate checks let attackers intercept data"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ibm-turbonomic", "infrastructure", "kubernetes", "kubeturbo"]
not_affected_if: ["version-outside-8.16.0-to-8.21.2"]
published_at: "2026-11-08T18:17:01+00:00"
first_seen_at: "2026-11-08T18:22:21+00:00"
updated_at: "2026-11-08T18:22:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14434", "first_seen_at": "2026-11-08T18:22:21+00:00"}]
exploit_sources: []
---

# IBM Turbonomic kubeturbo: TLS certificate checks let attackers intercept data

Link for people: https://infrastack.ai/live/CVE-2026-14434 (this .md is for agents)

The kubeturbo agent in IBM Turbonomic versions 8.16.0 through 8.21.2 does not properly validate TLS certificates. A machine-in-the-middle attacker on the network path can obtain sensitive information from the agent's connections.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the kubeturbo agent version in the Turbonomic deployment, for example `kubectl get deployment kubeturbo -n turbonomic -o jsonpath='{.spec.template.spec.containers[0].image}'` (namespace and deployment name may differ)

## Timeline

- 2026-11-08T18:22:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-14434

## From the sources

IBM Turbonomic kubeturbo agent 8.16.0 through 8.21.2 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_