omni vulnerabilities

3 known vulnerabilities in omni from Siderolabs. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.6 High severity

  omni: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-45726Sep 17, 2026Siderolabs

  Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in i

• 7.0 High severity

  omni: Authentication Bypass by Capture-replay

  CVE-2026-45720Sep 17, 2026Siderolabs

  Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent req

• 7.5 High severity

  omni: NULL Pointer Dereference

  CVE-2025-59836Oct 13, 2025Siderolabs

  Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, there is a nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sendin