Skip to content
OpenAdvisories

Package · Go

github.com/siderolabs/omni

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.0
    CVE-2026-45720

    Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token

    Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent re…

    siderolabs omni github.com/siderolabs/omni Go
  • High 7.6
    CVE-2026-45726

    Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService

    Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in …

    siderolabs omni github.com/siderolabs/omni Go
  • High 8.6
    CVE-2025-61688

    Omni leaks information via the API

    Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, Omni might leak sensitive information via an API.

    siderolabs omni github.com/siderolabs/omni Go