---
id: "CVE-2026-14435"
page: "https://infrastack.ai/live/CVE-2026-14435"
kind: "vulnerability"
aliases: ["CVE-2026-14435"]
title: "IBM Turbonomic kubeturbo agent skips TLS certificate checks, enabling interception"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ibm-turbonomic", "infrastructure", "kubernetes", "kubeturbo"]
not_affected_if: ["version-outside-range"]
published_at: "2026-11-08T18:17:01+00:00"
first_seen_at: "2026-11-08T18:22:21+00:00"
updated_at: "2026-11-08T18:22:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14435", "first_seen_at": "2026-11-08T18:22:21+00:00"}]
exploit_sources: []
---

# IBM Turbonomic kubeturbo agent skips TLS certificate checks, enabling interception

Link for people: https://infrastack.ai/live/CVE-2026-14435 (this .md is for agents)

The kubeturbo agent in IBM Turbonomic 8.16.0 through 8.20.3 does not properly validate TLS certificates when connecting. An attacker positioned in the network path can intercept the traffic and obtain sensitive information.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed kubeturbo agent version against the affected range 8.16.0 through 8.20.3 in the Turbonomic deployment

## Timeline

- 2026-11-08T18:22:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-14435

## From the sources

IBM Turbonomic kubeturbo agent 8.16.0 through 8.20.3 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle techniques.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_