Skip to content
OpenAdvisories

Package · Go

github.com/siderolabs/omni

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • High 7.0
    CVE-2026-45720

    Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token

    Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent re…

    siderolabs omni github.com/siderolabs/omni Go
  • Low 2.7
    CVE-2026-45723

    Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic

    Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions wi…

    siderolabs omni github.com/siderolabs/omni Go
  • High 7.6
    CVE-2026-45726

    Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService

    Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in …

    siderolabs omni github.com/siderolabs/omni Go
  • High 8.6
    CVE-2025-61688

    Omni leaks information via the API

    Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, Omni might leak sensitive information via an API.

    siderolabs omni github.com/siderolabs/omni Go
  • Medium 5.3
    CVE-2025-59836

    Omni is Vulnerable to DoS via Empty Create/Update Resource Requests

    Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, there is a nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sendi…

    siderolabs omni github.com/siderolabs/omni Go
  • Low 0.5
    CVE-2025-59824

    Omni Wireguard SideroLink potential escape

    Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to version 0.48.0, Omni Wireguard SideroLink has the potential to escape. Omni and each Talos machine establish a peer-to-peer (P2P) SideroLink connection using WireGuard to mutuall…

    siderolabs omni github.com/siderolabs/omni Go