CVE-2026-45723 Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic
An authenticated operator can exploit unsanitized input to probe internal endpoints on the image-factory host, potentially disclosing diagnostic information.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45723?
CVE-2026-45723 is a low-severity server-side request forgery vulnerability in siderolabs omni, published on 17 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, and url.URL.JoinPath normalizes them into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics while preventing redirection to another host or write requests. This issue is fixed in versions 1.6.6 and 1.7.3.
Which versions are affected by CVE-2026-45723?
5 open source packages ship an affected version, including github.com/siderolabs/omni.
| Package | Affected | Fixed in |
|---|---|---|
github.com/siderolabs/omni Go | All versions | 1.6.6, 1.7.3 |
github.com/siderolabs/omni Go | All versions | 1.6.6 |
github.com/siderolabs/omni Go | All versions | 1.6.6 |
github.com/siderolabs/omni Go | From 1.7.0 | 1.7.3 |
github.com/siderolabs/omni Go | From 1.7.0 | 1.7.3 |
How do I fix CVE-2026-45723?
Upgrade github.com/siderolabs/omni to a fixed version for your release line: 1.6.6 or 1.7.3.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-45723 being exploited?
There is no known exploitation of CVE-2026-45723 in the wild and no public exploit code.
Sources
Also known as GHSA-c66c-vq6w-fvh5, GO-2026-5316.