CVE-2026-45723
LowCVSS 2.7Summary
In Omni before versions 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, which url.URL.JoinPath normalizes into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics.
Risk Assessment
An authenticated Operator can probe internal endpoints on the image-factory host and access diagnostic information, potentially aiding further attacks. Redirection to another host or write requests are not possible.
Recommendation
Upgrade Omni to version 1.6.6 or 1.7.3 (or later). Restrict Operator privileges and monitor for unusual requests to the image-factory.
Other vulnerabilities in Omni
See all- CVE-2026-45726High
In Omni (which manages Kubernetes on bare metal, virtual machines, or in a cloud) from 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in internal/backend/runtime/omni/state_access.go allow an authenticated user with the Reader role to retrieve the resource through ResourceService if the importing actor has not rotated those secrets, exposing Kubernetes, Talos, and etcd CA private keys plus the service-account key. The issue is fixed in versions 1.6.6 and 1.7.3.
- CVE-2026-45720High
In Omni before 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The issue is fixed in versions 1.6.6 and 1.7.3.
Original NVD description (English source)
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, and url.URL.JoinPath normalizes them into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics while preventing redirection to another host or write requests. This issue is fixed in versions 1.6.6 and 1.7.3.