Description
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, and url.URL.JoinPath normalizes them into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics while preventing redirection to another host or write requests. This issue is fixed in versions 1.6.6 and 1.7.3.
Published: 2026-09-17
Score: 2.7 Low
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-c66c-vq6w-fvh5 Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic
History

Thu, 17 Sep 2026 19:45:00 +0000

Type Values Removed Values Added
Description Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, and url.URL.JoinPath normalizes them into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics while preventing redirection to another host or write requests. This issue is fixed in versions 1.6.6 and 1.7.3.
Title Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic
Weaknesses CWE-20
CWE-209
CWE-22
CWE-441
CWE-918
References
Metrics cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-17T19:39:28.303Z

Reserved: 2026-05-13T05:51:48.666Z

Link: CVE-2026-45723

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-17T20:16:49.347

Modified: 2026-09-17T20:16:49.347

Link: CVE-2026-45723

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-20

    Improper Input Validation

  • CWE-209

    Generation of Error Message Containing Sensitive Information

  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-441

    Unintended Proxy or Intermediary ('Confused Deputy')

  • CWE-918

    Server-Side Request Forgery (SSRF)