CVE-2026-45726 siderolabs CVE debrief

Who should care

Omni users with Reader role access, Kubernetes administrators, security teams managing access controls, and operators managing cluster secrets and access controls should be aware of this issue. They should assess their exposure, review access controls, and plan for remediation or mitigation as necessary to prevent potential lateral movement and unauthorized certificate signing.

Why it matters

CVE-2026-45726 exposes sensitive CA private keys to authenticated users with Reader role in Omni, allowing potential lateral movement and unauthorized certificate signing.

• Potential for lateral movement within Kubernetes clusters
• Exposure of sensitive CA private keys
• Possible certificate signing for unauthorized identities
• Need for immediate access review and secret rotation

Technical summary

The issue allows an authenticated user with Reader role to retrieve ImportedClusterSecrets resource containing Kubernetes, Talos, and etcd CA private keys. This exposure could permit certificate signing for privileged identities such as system:masters, providing control of the imported cluster outside Omni's authorization boundary, including its workloads, credentials, and secrets. The Kubernetes CA private key permits certificate signing for privileged identities such as system:masters and provides control of the imported cluster.

Defensive priority

High-priority assessment and remediation recommended for Omni users with Reader role access.

Recommended defensive actions

• Assess exposure for Omni deployments with Reader role access
• Verify if ImportedClusterSecrets resources have been rotated
• Remediate by upgrading to versions 1.6.6 or 1.7.3
• Review and restrict access to ResourceService
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The issue allows an authenticated user with Reader role to retrieve ImportedClusterSecrets resource containing Kubernetes, Talos, and etcd CA private keys. This exposure could permit certificate signing for privileged identities.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.