Log in Start free

Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M

CVE-2026-45723Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic

Low 2.7

In plain English

A low-severity improper input validation in omni from siderolabs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)2.7Low
Exploit odds (30 days)0.5%top 57.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, and url.URL.JoinPath normalizes them into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics while preventing redirection to another host or write requests. This issue is fixed in versions 1.6.6 and 1.7.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/siderolabs/omni1.6.6, 1.7.3GO-2026-5316
Gogithub.com/siderolabs/omni1.6.6GHSA-c66c-vq6w-fvh5
Gogithub.com/siderolabs/omni1.7.3GHSA-c66c-vq6w-fvh5

Affected products (as reported)

VendorProductVersions
siderolabs omni < 1.6.6>= 1.7.0, < 1.7.3

Weakness: CWE-20, CWE-22, CWE-209, CWE-441, CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References