CVE-2025-59836
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
Prior to 1.1.5 and 1.0.2, a nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sending empty create/update resource requests through the API endpoints.
Risk Assessment
An unauthenticated attacker can remotely crash the Omni server, leading to service unavailability.
Recommendation
Update Omni to version 1.1.5 or 1.0.2 (or later) to fix the vulnerability.
Other vulnerabilities in Omni
See all- CVE-2026-45726High
In Omni (which manages Kubernetes on bare metal, virtual machines, or in a cloud) from 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in internal/backend/runtime/omni/state_access.go allow an authenticated user with the Reader role to retrieve the resource through ResourceService if the importing actor has not rotated those secrets, exposing Kubernetes, Talos, and etcd CA private keys plus the service-account key. The issue is fixed in versions 1.6.6 and 1.7.3.
- CVE-2026-45723Low
In Omni before versions 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, which url.URL.JoinPath normalizes into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics.
- CVE-2026-45720High
In Omni before 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The issue is fixed in versions 1.6.6 and 1.7.3.
- CVE-2025-61688High
Omni before versions 1.1.5 and 1.0.2 may leak sensitive information via an API. The vulnerability affects Kubernetes management on bare metal, virtual machines, or in the cloud.
Original NVD description (English source)
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, there is a nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sending empty create/update resource requests through the API endpoints. The vulnerability exists in the isSensitiveSpec function which calls grpcomni.CreateResource without checking if the resource's metadata field is nil. When a resource is created with an empty Metadata field, the CreateResource function attempts to access resource.Metadata.Version causing a segmentation fault. This vulnerability is fixed in 1.1.5 and 1.0.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS