Riskcovery

CVE-2026-45723

Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic

State
Published
Severity
2.7 Low
Published
Sep 17, 2026
Updated
Sep 18, 2026
Reserved
May 13, 2026

Read the record on cve.org

Description

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, and url.URL.JoinPath normalizes them into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics while preventing redirection to another host or write requests. This issue is fixed in versions 1.6.6 and 1.7.3.

Scores

CVSSScoreVectorSource
3.12.7 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NGitHub_M

Weaknesses

  • CWE-20 Improper Input Validation
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-209 Generation of Error Message Containing Sensitive Information
  • CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')
  • CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

ProductVersions
omnisiderolabs
  • < 1.6.6Affected
  • >= 1.7.0, < 1.7.3Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.