CVE-2025-61688

Omni leaks information via the API

State: Published
Severity: 8.6 High
Published: Oct 13, 2025
Updated: Oct 14, 2025
Reserved: Sep 29, 2025

Description

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, Omni might leak sensitive information via an API.

Scores

CVSS	Score	Vector	Source
3.1	8.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
omnisiderolabs	>= 1.1.0-beta.0, < 1.1.5Affected < 1.0.2Affected

References

https://github.com/siderolabs/omni/security/advisories/GHSA-77r9-w39m-9xh5

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.