Skip to content
OpenAdvisories

Vendor

siderolabs

8 known vulnerabilities.

Products

omni 6 talos 2
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.0
    CVE-2026-45720

    Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token

    Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent re…

    siderolabs omni github.com/siderolabs/omni Go
  • High 7.6
    CVE-2026-45726

    Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService

    Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in …

    siderolabs omni github.com/siderolabs/omni Go
  • High 8.6
    CVE-2025-61688

    Omni leaks information via the API

    Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, Omni might leak sensitive information via an API.

    siderolabs omni github.com/siderolabs/omni Go
  • High 7.2
    CVE-2022-36103

    Talos worker join token can be used to get elevated access level to the Talos API

    Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluster. Due to improper validation of the request while signing a worker node CSR (certificate signing request) Talos con…

    siderolabs talos github.com/talos-systems/talos Go