Log in Start free

Vulnerability · Published Sep 17, 2026 · Assigned by GitHub_M

CVE-2026-45726Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService

High 7.6

In plain English

A high-severity information exposure in omni from siderolabs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.1%top 96.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in internal/backend/runtime/omni/state_access.go allow an authenticated user with the Reader role to retrieve the resource through ResourceService if the importing actor has not rotated those secrets, exposing Kubernetes, Talos, and etcd CA private keys plus the service-account key. The Kubernetes CA private key permits certificate signing for privileged identities such as system:masters and provides control of the imported cluster outside Omni's authorization boundary, including its workloads, credentials, and secrets. This issue is fixed in versions 1.6.6 and 1.7.3.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/siderolabs/omni1.6.6, 1.7.3GO-2026-5725
Gogithub.com/siderolabs/omni1.6.6GHSA-wv8c-6mx2-xf4j
Gogithub.com/siderolabs/omni1.7.3GHSA-wv8c-6mx2-xf4j

Affected products (as reported)

VendorProductVersions
siderolabs omni >= 1.3.0, < 1.6.6

Weakness: CWE-200, CWE-522, CWE-732 · Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

References