Vulnerability-Lookup

CNVD-2026-19711

Vulnerability from cnvd - Published: 2026-05-19

Title

IBM Turbonomic prometurbo agent权限提升漏洞

Description

IBM Turbonomic prometurbo agent是IBM Turbonomic Application Resource Management中的一个组件，用于管理资源配置。 IBM Turbonomic prometurbo agent存在权限提升漏洞。该漏洞源于过度的集群范围权限设置，导致对所有密钥的无限制读取访问。攻击者可利用该漏洞窃取敏感凭证，提升权限并可能完全攻陷整个集群。

Severity

中

Patch Name

IBM Turbonomic prometurbo agent权限提升漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.ibm.com/support/pages/node/7270720

Reference

https://nvd.nist.gov/vuln/detail/CVE-2026-6389

Impacted products

Name
IBM Turbonomic prometurbo agent >=8.16.0，<=8.17.6

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2026-6389",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-6389"
    }
  },
  "description": "IBM Turbonomic prometurbo agent\u662fIBM Turbonomic Application Resource Management\u4e2d\u7684\u4e00\u4e2a\u7ec4\u4ef6\uff0c\u7528\u4e8e\u7ba1\u7406\u8d44\u6e90\u914d\u7f6e\u3002\n\nIBM Turbonomic prometurbo agent\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8fc7\u5ea6\u7684\u96c6\u7fa4\u8303\u56f4\u6743\u9650\u8bbe\u7f6e\uff0c\u5bfc\u81f4\u5bf9\u6240\u6709\u5bc6\u94a5\u7684\u65e0\u9650\u5236\u8bfb\u53d6\u8bbf\u95ee\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7a83\u53d6\u654f\u611f\u51ed\u8bc1\uff0c\u63d0\u5347\u6743\u9650\u5e76\u53ef\u80fd\u5b8c\u5168\u653b\u9677\u6574\u4e2a\u96c6\u7fa4\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.ibm.com/support/pages/node/7270720",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2026-19711",
  "openTime": "2026-05-19",
  "patchDescription": "IBM Turbonomic prometurbo agent\u662fIBM Turbonomic Application Resource Management\u4e2d\u7684\u4e00\u4e2a\u7ec4\u4ef6\uff0c\u7528\u4e8e\u7ba1\u7406\u8d44\u6e90\u914d\u7f6e\u3002\r\n\r\nIBM Turbonomic prometurbo agent\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u8fc7\u5ea6\u7684\u96c6\u7fa4\u8303\u56f4\u6743\u9650\u8bbe\u7f6e\uff0c\u5bfc\u81f4\u5bf9\u6240\u6709\u5bc6\u94a5\u7684\u65e0\u9650\u5236\u8bfb\u53d6\u8bbf\u95ee\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7a83\u53d6\u654f\u611f\u51ed\u8bc1\uff0c\u63d0\u5347\u6743\u9650\u5e76\u53ef\u80fd\u5b8c\u5168\u653b\u9677\u6574\u4e2a\u96c6\u7fa4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM Turbonomic prometurbo agent\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "IBM Turbonomic prometurbo agent \u003e=8.16.0\uff0c\u003c=8.17.6"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2026-6389",
  "serverity": "\u4e2d",
  "submitTime": "2026-05-06",
  "title": "IBM Turbonomic prometurbo agent\u6743\u9650\u63d0\u5347\u6f0f\u6d1e"
}

CVE-2026-6389 (GCVE-0-2026-6389)

Vulnerability from cvelistv5 – Published: 2026-04-30 21:17 – Updated: 2026-05-01 16:37

Title

IBM Turbonomic Prometurbo agent used by IBM Turbonomic Application Resource Management is affected by a single vulnerability

Summary

IBM Turbonomic prometurbo agent 8.16.0 through 8.17.6 IBM Turbonomic Application Resource Management grants excessive cluster‑wide permissions, including unrestricted read access to all secrets. An attacker that compromises the operator or its service account can exfiltrate sensitive credentials, escalate privileges, and potentially achieve full cluster compromise.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-01 16:07 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

ibm mitre root Scorecard

References

1 reference

URL	Tags
https://www.ibm.com/support/pages/node/7270720	vendor-advisorypatch

Impacted products

1 product

Vendor	Product	Version
IBM	Turbonomic prometurbo agent	Affected: 8.16.0 , ≤ 8.17.6 (semver) cpe:2.3:a:ibm:turbonomic_prometurbo_agent:8.16.0:::::::* cpe:2.3:a:ibm:turbonomic_prometurbo_agent:8.17.6:::::::*

Credits

This vulnerability was reported to IBM by Lior Yakim.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6389",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-01T16:07:22.169751Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-01T16:37:57.048Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:turbonomic_prometurbo_agent:8.16.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:turbonomic_prometurbo_agent:8.17.6:*:*:*:*:*:*:*"
          ],
          "product": "Turbonomic prometurbo agent",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "8.17.6",
              "status": "affected",
              "version": "8.16.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This vulnerability was reported to IBM by Lior Yakim."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIBM Turbonomic prometurbo agent 8.16.0 through 8.17.6 IBM Turbonomic Application Resource Management grants excessive cluster\u2011wide permissions, including unrestricted read access to all secrets. An attacker that compromises the operator or its service account can exfiltrate sensitive credentials, escalate privileges, and potentially achieve full cluster compromise.\u003c/p\u003e"
            }
          ],
          "value": "IBM Turbonomic prometurbo agent 8.16.0 through 8.17.6 IBM Turbonomic Application Resource Management grants excessive cluster\u2011wide permissions, including unrestricted read access to all secrets. An attacker that compromises the operator or its service account can exfiltrate sensitive credentials, escalate privileges, and potentially achieve full cluster compromise."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-30T21:17:06.371Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7270720"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003eIBM strongly recommends addressing the vulnerability now by re-installing a version of prometurbo with the required fixes.\u003c/strong\u003e\u003c/p\u003e\u003cdiv\u003e\u003ctable\u003e\u003ctbody\u003e\u003ctr\u003e\u003ctd\u003e\u003cstrong\u003eProduct(s)\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eVersion(s) number and/or range\u0026nbsp;\u003c/strong\u003e\u003c/td\u003e\u003ctd\u003e\u003cstrong\u003eRemediation/Fix/Instructions\u003c/strong\u003e\u003c/td\u003e\u003c/tr\u003e\u003ctr\u003e\u003ctd\u003eIBM Turbonomic prometurbo agent\u003c/td\u003e\u003ctd\u003e8.18.0\u003c/td\u003e\u003ctd\u003e\u003cp\u003eFollow the \u003ca href=\"https://www.ibm.com/docs/en/tarm/8.19.4?topic=configuration-prometheus\" rel=\"nofollow\"\u003einstallation instructions\u003c/a\u003e from the IBM Turbonomic documentation\u003c/p\u003e\u003c/td\u003e\u003c/tr\u003e\u003c/tbody\u003e\u003c/table\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "IBM strongly recommends addressing the vulnerability now by re-installing a version of prometurbo with the required fixes.\n\nProduct(s)Version(s) number and/or range\u00a0Remediation/Fix/InstructionsIBM Turbonomic prometurbo agent8.18.0\n\nFollow the  installation instructions https://www.ibm.com/docs/en/tarm/8.19.4  from the IBM Turbonomic documentation"
        }
      ],
      "title": "IBM Turbonomic Prometurbo agent used by IBM Turbonomic Application Resource Management is affected by a single vulnerability",
      "x_generator": {
        "engine": "ibm-cvegen"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2026-6389",
    "datePublished": "2026-04-30T21:17:06.371Z",
    "dateReserved": "2026-04-15T19:41:36.801Z",
    "dateUpdated": "2026-05-01T16:37:57.048Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2026-19711

CVE-2026-6389 (GCVE-0-2026-6389)

Tags

Sightings

Nomenclature

Related by attack behaviour