CVE-2026-45726highCWE-200CWE-522CWE-732

CVE-2026-45726: falha de alta gravidade em siderolabs omni

Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar omni+ Monitorar github.com/siderolabs/omni

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.6epss 0.1%
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in internal/backend/runtime/omni/state_access.go allow an authenticated user with the Reader role to retrieve the resource through ResourceService if the importing actor has not rotated those secrets, exposing Kubernetes, Talos, and etcd CA private keys plus the service-account key. The Kubernetes CA private key permits certificate signing for privileged identities such as system:masters and provides control of the imported cluster outside Omni's authorization boundary, including its workloads, credentials, and secrets. This issue is fixed in versions 1.6.6 and 1.7.3.
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Produtos afetados
siderolabs · omni
CVEs relacionadas — siderolabs omni

No mesmo produto, das mais perigosas para as menos.

CVE-2025-59836MEDIUMOmni is Vulnerable to DoS via Empty Create/Update Resource RequestsEPSS 0.6%CVE-2026-45723LOWOmni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematicEPSS 0.5%CVE-2025-61688HIGHOmni leaks information via the APIEPSS 0.3%CVE-2025-59824LOWOmni Wireguard SideroLink potential escapeEPSS 0.2%CVE-2026-45720HIGHOmni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session tokenEPSS 0.1%