IBM Turbonomic prometurbo agent versions 8.16.0 through 8.17.6 improperly manage privileges by granting excessive cluster-wide permissions. This includes unrestricted read access to all secrets within the cluster. Such privilege mismanagement allows an attacker who gains control over the operator or its service account to exfiltrate sensitive credentials, escalate privileges, and potentially compromise the entire cluster. The vulnerability is classified under CWE-269 (Improper Privilege Management) and has a CVSS 3.1 score of 8.8, indicating high severity. No vendor advisory or patch information is currently available.

An attacker with access to the operator or its service account can leverage the excessive permissions to read all secrets in the cluster, leading to credential exfiltration and privilege escalation. This can result in full cluster compromise, affecting confidentiality, integrity, and availability of the affected environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit access to the operator and its service account, and monitor for any unauthorized access or suspicious activity related to these accounts.