{"id":"CVE-2026-14435","kind":"vulnerability","aliases":["CVE-2026-14435"],"related":[],"title":"IBM Turbonomic kubeturbo agent skips TLS certificate checks, enabling interception","description":"IBM Turbonomic kubeturbo agent 8.16.0 through 8.20.3 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.","summary":"The kubeturbo agent in IBM Turbonomic 8.16.0 through 8.20.3 does not properly validate TLS certificates when connecting. An attacker positioned in the network path can intercept the traffic and obtain sensitive information.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-turbonomic","infrastructure","kubernetes","kubeturbo"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed kubeturbo agent version against the affected range 8.16.0 through 8.20.3 in the Turbonomic deployment","fix":null,"status":"open","published_at":"2026-11-08T18:17:01+00:00","first_seen_at":"2026-11-08T18:22:21+00:00","triaged_at":"2026-11-08T18:22:50+00:00","updated_at":"2026-11-08T18:22:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-08T18:22:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"IBM Turbonomic kubeturbo agent skips TLS certificate checks, enabling interception","impact":"medium","summary":"The kubeturbo agent in IBM Turbonomic 8.16.0 through 8.20.3 does not properly validate TLS certificates when connecting. An attacker positioned in the network path can intercept the traffic and obtain sensitive information.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ibm-turbonomic","kubeturbo","kubernetes"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker intercepts traffic and reads sensitive information in transit","analyst_note":"Find the IBM security bulletin for CVE-2026-14435 to confirm the fixed version and which connections lack certificate validation.","how_to_check":"- Check the installed kubeturbo agent version against the affected range 8.16.0 through 8.20.3 in the Turbonomic deployment\n- unknown for further checks; the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running IBM Turbonomic with the kubeturbo agent in versions 8.16.0 through 8.20.3 are potentially exposed. An attacker must be able to sit between the agent and the server it talks to on the network. The sources do not say which configurations are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000729,"input_tokens":4543,"output_tokens":549,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-14435':13A,16A '-2026':12A,15A '8.16.0':29B,59C '8.20.3':31B,61C 'agent':4A,25B,58C 'allow':73C 'attack':41B,75C 'certif':7A,37B,69C 'check':8A 'connect':39B 'could':72C 'cve':11A,14A 'enabl':9A 'ibm':1A,18B,27B,55C 'ibm-turbonom':17B 'improp':66C 'inform':54B,79C 'infrastructur':20B 'intercept':10A,48B 'kubernet':21B 'kubeturbo':3A,22B,24B,57C 'man':81C 'middl':84C 'network':45B 'obtain':52B,77C 'path':46B 'posit':42B 'proper':34B 'sensit':53B,78C 'skip':5A 'techniqu':85C 'tls':6A,36B,68C 'traffic':50B 'turbonom':2A,19B,28B,56C 'use':80C 'valid':35B,64C,67C,70C","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Turbonomic with the kubeturbo agent in versions 8.16.0 through 8.20.3 are potentially exposed. An attacker must be able to sit between the agent and the server it talks to on the network. The sources do not say which configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ibmturbonomic","infrastructure","kubernetes","kubeturbo","medium"],"campaign_type":null,"search_a":"'-14435':13A,16A '-2026':12A,15A 'agent':4A 'certif':7A 'check':8A 'cve':11A,14A 'enabl':9A 'ibm':1A 'intercept':10A 'kubeturbo':3A 'skip':5A 'tls':6A 'turbonom':2A","search_b":"'8.16.0':29B '8.20.3':31B 'agent':25B 'attack':41B 'certif':37B 'connect':39B 'ibm':18B,27B 'ibm-turbonom':17B 'inform':54B 'infrastructur':20B 'intercept':48B 'kubernet':21B 'kubeturbo':22B,24B 'network':45B 'obtain':52B 'path':46B 'posit':42B 'proper':34B 'sensit':53B 'tls':36B 'traffic':50B 'turbonom':19B,28B 'valid':35B","search_c":"'8.16.0':59C '8.20.3':61C 'agent':58C 'allow':73C 'attack':75C 'certif':69C 'could':72C 'ibm':55C 'improp':66C 'inform':79C 'kubeturbo':57C 'man':81C 'middl':84C 'obtain':77C 'sensit':78C 'techniqu':85C 'tls':68C 'turbonom':56C 'use':80C 'valid':64C,67C,70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T18:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-14435","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14435","severity":null,"published_at":"2026-11-08T18:17:01+00:00","modified_at":"2026-11-08T18:17:01+00:00","first_seen_at":"2026-11-08T18:22:21+00:00","fetched_at":"2026-11-08T18:22:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}