CVE-2026-45723

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, and url.URL.JoinPath normalizes them into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics while preventing redirection to another host or write requests. This issue is fixed in versions 1.6.6 and 1.7.3.

CVSS v3 2.7 LOW

2.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/siderolabs/omni/commit/13c3f289789842e1fd954d98babb34b94eea1192
https://github.com/siderolabs/omni/commit/3e69e80802624bf322f16aa499d5eafca16d0025
https://github.com/siderolabs/omni/commit/9426c2cabccaa1d442bc8ebf28c16cae2d7c6ff7
https://github.com/siderolabs/omni/pull/2817
https://github.com/siderolabs/omni/releases/tag/v1.6.6
https://github.com/siderolabs/omni/releases/tag/v1.7.3
https://github.com/siderolabs/omni/security/advisories/GHSA-c66c-vq6w-fvh5

Configurations

No configuration.

History

17 Sep 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-17 20:16

Updated : 2026-09-23 18:12

NVD link : CVE-2026-45723

Mitre link : CVE-2026-45723

CVE.ORG link : CVE-2026-45723

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-209

Generation of Error Message Containing Sensitive Information

CWE-441

Unintended Proxy or Intermediary ('Confused Deputy')

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-45723", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45723", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-18T20:10:42.448358Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "siderolabs", "product": "omni", "versions": [{"status": "affected", "version": "< 1.6.6"}, {"status": "affected", "version": ">= 1.7.0, < 1.7.3"}]}]}], "published": "2026-09-17T20:16:49.347", "references": [{"url": "https://github.com/siderolabs/omni/commit/13c3f289789842e1fd954d98babb34b94eea1192", "source": "security-advisories@github.com"}, {"url": "https://github.com/siderolabs/omni/commit/3e69e80802624bf322f16aa499d5eafca16d0025", "source": "security-advisories@github.com"}, {"url": "https://github.com/siderolabs/omni/commit/9426c2cabccaa1d442bc8ebf28c16cae2d7c6ff7", "source": "security-advisories@github.com"}, {"url": "https://github.com/siderolabs/omni/pull/2817", "source": "security-advisories@github.com"}, {"url": "https://github.com/siderolabs/omni/releases/tag/v1.6.6", "source": "security-advisories@github.com"}, {"url": "https://github.com/siderolabs/omni/releases/tag/v1.7.3", "source": "security-advisories@github.com"}, {"url": "https://github.com/siderolabs/omni/security/advisories/GHSA-c66c-vq6w-fvh5", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-209"}, {"lang": "en", "value": "CWE-441"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, and url.URL.JoinPath normalizes them into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics while preventing redirection to another host or write requests. This issue is fixed in versions 1.6.6 and 1.7.3."}], "lastModified": "2026-09-23T18:12:04.247", "sourceIdentifier": "security-advisories@github.com"}