CVE-2026-45723lowCWE-20CWE-209CWE-22CWE-441CWE-918

CVE-2026-45723: low-severity vulnerability in siderolabs omni

Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic

Published · Updated

Follow this CVE+ Monitor omni+ Monitor github.com/siderolabs/omni

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 2.7epss 0.5%
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, and url.URL.JoinPath normalizes them into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics while preventing redirection to another host or write requests. This issue is fixed in versions 1.6.6 and 1.7.3.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Affected products
siderolabs · omni
Related CVEs — siderolabs omni

In the same product, most dangerous first.

CVE-2025-59836MEDIUMOmni is Vulnerable to DoS via Empty Create/Update Resource RequestsEPSS 0.6%CVE-2025-61688HIGHOmni leaks information via the APIEPSS 0.3%CVE-2025-59824LOWOmni Wireguard SideroLink potential escapeEPSS 0.2%CVE-2026-45720HIGHOmni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session tokenEPSS 0.1%CVE-2026-45726HIGHOmni: Reader-level users can retrieve imported cluster CA keys via ResourceServiceEPSS 0.1%