Is CVE-2026-45723 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45723 being exploited in the wild.

How severe is CVE-2026-45723?

Low severity, with a CVSS score of 3.1, published 17 September 2026.

Which products and versions are affected?

github.com/siderolabs/omni (Go) SEMVER:introduced=0,fixed=1.6.6, SEMVER:introduced=0,fixed=1.6.6,introduced=1.7.0,fixed=1.7.3; Sidero Labs Omni = 1.7.0, < 1.7.3.

Is there a fix for CVE-2026-45723?

Yes. github.com/siderolabs/omni (Go): upgrade to 1.6.6, 1.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45723 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-45723?

Check whether you run github.com/siderolabs/omni (Go) or Sidero Labs Omni at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45723: Sidero Labs Omni path traversal in CreateSchematic API

Q: Is there a fix for CVE-2026-45723?

Yes. github.com/siderolabs/omni (Go): upgrade to 1.6.6, 1.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45723 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-45723?

Check whether you run github.com/siderolabs/omni (Go) or Sidero Labs Omni at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45723 · Severity: low · CVSS 3.1 · Published 2026-09-17

Sidero Labs Omni, a management platform for Talos Linux, contains a vulnerability where an authorized administrator (Operator) can access unintended internal API paths. By manipulating version fields, an attacker can force the system to probe internal network services or leak diagnostic information from the image-factory server. This could lead to the exposure of internal server details or sensitive configuration data.

Technologies: github.com/siderolabs/omni (Go), Sidero Labs Omni. Vendors: Go, Sidero Labs.

Quick answers

Is CVE-2026-45723 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45723 being exploited in the wild.
How severe is CVE-2026-45723?: Low severity, with a CVSS score of 3.1, published 17 September 2026.
Which products and versions are affected?: github.com/siderolabs/omni (Go) SEMVER:introduced=0,fixed=1.6.6, SEMVER:introduced=0,fixed=1.6.6,introduced=1.7.0,fixed=1.7.3; Sidero Labs Omni < 1.6.6, >= 1.7.0, < 1.7.3.
Is there a fix for CVE-2026-45723?: Yes. github.com/siderolabs/omni (Go): upgrade to 1.6.6, 1.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45723 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-45723?: Check whether you run github.com/siderolabs/omni (Go) or Sidero Labs Omni at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siderolabs/omni (Go): upgrade to 1.6.6, 1.7.3 or later
```
go get github.com/siderolabs/omni@v1.7.3
```

Technical details

A path traversal vulnerability exists in the `managementServer.CreateSchematic` function within `internal/backend/grpc/schematics.go`. The `TalosVersion` field is passed without sanitization to `imageFactoryClient.OverlaysVersions`, where it is used to construct a URL path. Because `url.URL.JoinPath` resolves `../` sequences, an authenticated Operator can traverse the API path on the configured image-factory server. This allows for Server-Side Request Forgery (SSRF) limited to the image-factory host, where error responses from unintended endpoints are reflected back to the user, potentially leaking internal diagnostics. The issue is fixed in versions 1.6.6 and 1.7.3.

Affected products

Sidero Labs Omni < 1.6.6, >= 1.7.0, < 1.7.3

Identifiers

CVE-2026-45723
GHSA-c66c-vq6w-fvh5
GO-2026-5316

Timeline

2026-06-05: disclosed
2026-06-05: patched
2026-06-05: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.