---
id: CVE-2026-45723
title: 'Omni manages Kubernetes on bare metal, virtual machines, or in a cloud'
summary: >-
  Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior
  to 1.6.6 and 1.7.3, managementServer.CreateSchematic in
  internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion
  field to imageFactoryClie…
severity: low
cvss: 2.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'
cwe:
  - CWE-20
  - CWE-22
  - CWE-209
  - CWE-441
  - CWE-918
vendor: siderolabs
product: omni
affected:
  - omni < 1.6.6
  - 'omni >= 1.7.0, < 1.7.3'
published: '2026-09-17'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:12:04.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-45723'
references:
  - url: >-
      https://github.com/siderolabs/omni/commit/13c3f289789842e1fd954d98babb34b94eea1192
    label: security-advisories@github.com
  - url: >-
      https://github.com/siderolabs/omni/commit/3e69e80802624bf322f16aa499d5eafca16d0025
    label: security-advisories@github.com
  - url: >-
      https://github.com/siderolabs/omni/commit/9426c2cabccaa1d442bc8ebf28c16cae2d7c6ff7
    label: security-advisories@github.com
  - url: 'https://github.com/siderolabs/omni/pull/2817'
    label: security-advisories@github.com
  - url: 'https://github.com/siderolabs/omni/releases/tag/v1.6.6'
    label: security-advisories@github.com
  - url: 'https://github.com/siderolabs/omni/releases/tag/v1.7.3'
    label: security-advisories@github.com
  - url: 'https://github.com/siderolabs/omni/security/advisories/GHSA-c66c-vq6w-fvh5'
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
epss: 0.00494
epssPercentile: 0.39945
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-18T20:10:42.448358Z'
ingestedAt: '2026-09-17T20:28:02.771Z'
---

## Overview

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, and url.URL.JoinPath normalizes them into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics while preventing redirection to another host or write requests. This issue is fixed in versions 1.6.6 and 1.7.3.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.