CVE-2026-45726
Published:June 05, 2026
Updated:August 27, 2026
Omni supports importing standalone Talos clusters. During this process, an ImportedClusterSecrets resource is created, which contains the full CA secrets bundle for the cluster being imported. If these secrets are not rotated by the importing actor, an authenticated Omni user with Reader access can read this resource and gain full access to the Talos, Kubernetes and etcd APIs of the cluster.
Affected Packages
https://github.com/siderolabs/omni.git (GITHUB):
Affected version(s) >=v1.3.0 <v1.6.6Fix Suggestion:
Update to version v1.6.6https://github.com/siderolabs/omni.git (GITHUB):
Affected version(s) >=v1.7.0 <v1.7.3Fix Suggestion:
Update to version v1.7.3github.com/siderolabs/omni (GO):
Affected version(s) >=v1.3.0 <v1.6.6Fix Suggestion:
Update to version v1.6.6github.com/siderolabs/omni (GO):
Affected version(s) >=v1.7.0 <v1.7.3Fix Suggestion:
Update to version v1.7.3Related Resources (4)
Do you need more information?
Contact UsCVSS v4
Base Score:
7.3
Attack Vector
ADJACENT
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
PASSIVE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
HIGH
Subsequent System Availability
HIGH
CVSS v3
Base Score:
7.6
Attack Vector
ADJACENT
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Weakness Type (CWE)
EPSS
Base Score:
0.02