CVE-2026-45723 siderolabs CVE debrief

Who should care

Operators and administrators of Omni, particularly those managing Kubernetes on bare metal, virtual machines, or in a cloud, should assess exposure and apply patches. They should also verify their deployment against the affected versions and monitor for unusual activity. Additionally, security teams and vulnerability management teams should review the issue and plan for potential mitigations.

Why it matters

CVE-2026-45723 allows authenticated Operators to potentially disclose internal diagnostics and probe same-host endpoints in Omni deployments prior to versions 1.6.6 and 1.7.3.

• Possible disclosure of internal diagnostics
• Same-host endpoint probing by authenticated Operators
• Verification of patch deployment and configuration changes

Technical summary

The managementServer.CreateSchematic function in Omni passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validation, allowing an authenticated Operator to submit traversal segments and issue HTTP GET requests to unintended paths on the image-factory host. This enables same-host endpoint probing and possible disclosure of internal diagnostics. The issue is fixed in versions 1.6.6 and 1.7.3, and operators should verify their deployment against the affected versions and apply patches.

Defensive priority

Operators and administrators of Omni should verify their deployment against the affected versions and apply patches to prevent potential diagnostic exposure.

Recommended defensive actions

• Verify Omni deployment against affected versions (prior to 1.6.6 and 1.7.3)
• Apply patches to prevent potential diagnostic exposure
• Monitor for unusual HTTP GET requests to image-factory host paths
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Omni, including the affected versions (prior to 1.6.6 and 1.7.3) and fixed versions. The issue is caused by the managementServer.CreateSchematic function passing the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validation. This allows an authenticated Operator to submit traversal segments and issue HTTP GET requests to unintended paths on the image-factory host. The CVE record was published on 2026-09-17T20:16:49.347Z and has a

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.