Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-45726— Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService

Quick assessment

Affected

siderolabs omni

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Omni 可在裸机、虚拟机或云环境中管理 Kubernetes 集群。在版本 1.3.0 至 1.6.6 以及 1.7.3 中，导入一个独立的 Talos 集群时，会创建一个名为的资源，其中包含该集群完整的 CA 密钥包。中的访问控制规则允许拥有 Reader 角色的已认证用户通过 ResourceService 获取该资源（前提是执行导入的操作者尚未轮换这些密钥），从而泄露 Kubernetes、Talos 和 etcd 的 CA 私钥以及服务账户密钥。Kubernetes CA 私钥可用于为高权限身份（如

CVSS 7.6 · High EPSS 0.14% · P3 Updated Sep 23, 2026

Possible ATT&CK Techniques 2 AI

T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
siderolabs	omni	`>= 1.3.0, < 1.6.6`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService

Source: CVE Program / CVE List V5

Vulnerability Description

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in internal/backend/runtime/omni/state_access.go allow an authenticated user with the Reader role to retrieve the resource through ResourceService if the importing actor has not rotated those secrets, exposing Kubernetes, Talos, and etcd CA private keys plus the service-account key. The Kubernetes CA private key permits certificate signing for privileged identities such as system:masters and provides control of the imported cluster outside Omni's authorization boundary, including its workloads, credentials, and secrets. This issue is fixed in versions 1.6.6 and 1.7.3.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
siderolabs	omni	>= 1.3.0, < 1.6.6	-

II. Public POCs for CVE-2026-45726

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-45726

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-45726 (4)

Vendor Advisories for CVE-2026-45726 (1)

🔗 Reader-level users can retrieve imported cluster CA keys via ResourceService · Advisory · siderolabs/omni · GitHub x_refsource_CONFIRM

Vendor Pages for CVE-2026-45726 (2)

🔗 Release v1.6.6 · siderolabs/omni · GitHub Read full article x_refsource_MISC
🔗 Release v1.7.3 · siderolabs/omni · GitHub x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-45726

Same Patch Batch · siderolabs · 2026-09-17 · 3 CVEs total

CVE-2026-45720	7.0 HIGH	Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session t
CVE-2026-45723	2.7 LOW	Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in Cre

IV. Related Vulnerabilities

Same product: omni

Same vendor: siderolabs

Same weakness: CWE-200