CVE•Published 2026-04-30•Modified 2026-05-05•1 article on news•6 live references•NVD data
CVE-2026-6389Ibm · Turbonomic_prometurbo_agent
Vulnerability data via NVD (ingested)
CVSS v3.1
8.8
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS percentile
1
Exploit Prediction Scoring System · top 99% of all CVEs
Weaknesses (CWE)
Description
IBM Turbonomic prometurbo agent 8.16.0 through 8.17.6 IBM Turbonomic Application Resource Management grants excessive cluster‑wide permissions, including unrestricted read access to all secrets. An attacker that compromises the operator or its service account can exfiltrate sensitive credentials, escalate privileges, and potentially achieve full cluster compromise.
Timeline
Published 2026-04-30
Modified 2026-05-05
External references
Search for exposed instances
Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).
Shodan · vuln tag0 hosts
vuln:CVE-2026-6389Hosts Shodan has explicitly fingerprinted as vulnerable.
Shodan · product
product:"Ibm Turbonomic Prometurbo Agent"All exposed Ibm Turbonomic Prometurbo Agent instances — cross-reference with the CVE's affected-version range.
Shodan · banner/body mention
http.html:"Turbonomic Prometurbo Agent"HTTP body or banner mentions "Turbonomic Prometurbo Agent" — catches deploys Shodan didn't identify as a product.
More intel sources (5)
Shodan report
vuln:CVE-2026-6389Country / ASN / product breakdown for the vuln query.
Censys
vulnerabilities.cve_id: CVE-2026-6389Censys host search filtered to this CVE id.
grep.app
CVE-2026-6389Public source-code mentions — fast PoC discovery.
GitHub code
CVE-2026-6389GitHub code search for direct mentions.
Google dork
"CVE-2026-6389" exploit -site:nvd.nist.govWrite-ups and news, NVD excluded.
Known PoCs on GitHub (8)
CVE-2026-63898 repos
nomi-sec/PoC-in-GitHubunknown
📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.
Mr-xn/Penetration_Testing_POCHTML
渗透测试有关的POC、EXP、脚本、提权、小工具等---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss csrf-webshell cobub-razor cve rce sql sql-poc poc-exp bypas…
InMyMine7/MephistoPython
A comprehensive WordPress vulnerability scanner and exploitation framework for authorized penetration testing. This tool automatically detects and exploits multiple WordPress secur…
tycloud97/awesome-starsunknown
A curated list of my GitHub stars by stargazed
eilandert/wordpress-hardening-pluginShell
Plugin for Owasp CRS4.0+ (modsecurity) to harden wordpress
oslook/n8n-workflowsunknown
4200 + Workflow Automation Templates are Grouped by Categories/Services for easy navigation
timoguin/starsunknown
My starred repositories
KalzzEngine/darkthornPython
Darkthorn adalah toolkit pengujian ketahanan server untuk praktisi keamanan siber. Dirancang untuk stress testing dan analisis performa infrastruktur secara legal.