CVE-2026-6389 is a privilege management vulnerability in IBM Turbonomic prometurbo agent versions 8.16.0 through 8.17.6. The agent grants excessive cluster-wide permissions, including unrestricted read access to all secrets within the cluster. This improper privilege assignment allows an attacker who gains control over the operator or its service account to exfiltrate sensitive credentials, escalate privileges, and potentially achieve full cluster compromise. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-269 (Improper Privilege Management). There is no vendor advisory or patch available at this time, and the product is not a cloud service, so remediation is the responsibility of the user.

If exploited, this vulnerability allows an attacker with access to the operator or its service account to read all secrets in the cluster, leading to credential theft and privilege escalation. This can result in full cluster compromise, affecting confidentiality, integrity, and availability of the environment. The high CVSS score (8.8) reflects the critical nature of the impact. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, users should restrict access to the operator and its service account to trusted personnel only and monitor for suspicious activity related to these accounts. Review and minimize permissions granted to the prometurbo agent where possible until a vendor fix is released.