Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-45723— Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic

Quick assessment

Affected
siderolabs omni
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

这段漏洞描述涉及 Omni（一个用于在裸金属、虚拟机或云环境中管理 Kubernetes 的工具）。以下是该段落的中文翻译： Omni 可用于管理运行在裸金属、虚拟机或云环境中的 Kubernetes。在 1.6.6 和 1.7.3 版本之前， 文件中的 函数将调用者可控的 字段直接传递给 ，且未对其进行版本格式校验。 经过认证的 Operator 用户可以在 字段中注入路径遍历段（如 ），而 会将这些段规范化为配置好的 image-factory 主机上的非预期路径。随后，Omni 会向这些路径发起 HTTP G

CVSS 2.7 · Low EPSS 0.04% · P14

Possible ATT&CK Techniques 2 AI

T1117 T1595 · Active Scanning

Affected Version Matrix 2

VendorProduct Version RangeStatus
siderolabs omni < 1.6.6 affected
>= 1.7.0, < 1.7.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-45723

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic
Source: CVE Program / CVE List V5
Vulnerability Description
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, and url.URL.JoinPath normalizes them into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics while preventing redirection to another host or write requests. This issue is fixed in versions 1.6.6 and 1.7.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
siderolabs omni < 1.6.6 -

II. Public POCs for CVE-2026-45723

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-45723

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-45723 (4)

Vendor Advisories for CVE-2026-45723 (1)

Vendor Pages for CVE-2026-45723 (2)

Same Patch Batch · siderolabs · 2026-09-17 · 3 CVEs total

CVE-2026-45726 7.6 HIGH Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService
CVE-2026-45720 7.0 HIGH Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session t

IV. Related Vulnerabilities

Same product: omni
Same vendor: siderolabs
Same weakness: CWE-20

V. Comments for CVE-2026-45723

No comments yet

Leave a comment