Siderolabs vulnerabilities
We track 4 vulnerabilities in Siderolabs products across 3 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 17, 2026.
Latest Siderolabs vulnerabilities
- 7.6 High severity
omni: Exposure of Sensitive Information to an Unauthorized Actor
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in i
- 7.0 High severity
omni: Authentication Bypass by Capture-replay
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent req
- 7.5 High severity
omni: NULL Pointer Dereference
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, there is a nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sendin
- 8.8 High severity
talos: Incorrect Authorization
Talos Linux is a Linux distribution built for Kubernetes deployments. Talos worker nodes use a join token to get accepted into the Talos cluster. Due to improper validation of the request while signing a worker node CSR (certificate signing request) Talos cont