# CVE-2026-45723: Sidero Labs Omni path traversal in CreateSchematic API

Source: https://junglewise.ai/threats/cve-2026-45723-sidero-labs-omni-path-traversal-in-createschematic-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-45723 · Severity: low · CVSS 3.1 · Published 2026-09-17

Sidero Labs Omni, a management platform for Talos Linux, contains a vulnerability where an authorized administrator (Operator) can access unintended internal API paths. By manipulating version fields, an attacker can force the system to probe internal network services or leak diagnostic information from the image-factory server. This could lead to the exposure of internal server details or sensitive configuration data.

Technologies: [github.com/siderolabs/omni (Go)](https://junglewise.ai/threats/technologies/github-com-siderolabs-omni), [Sidero Labs Omni](https://junglewise.ai/threats/technologies/omni). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Sidero Labs](https://junglewise.ai/threats/vendors/sidero-labs).

## Quick answers

**Is CVE-2026-45723 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45723 being exploited in the wild.

**How severe is CVE-2026-45723?** Low severity, with a CVSS score of 3.1, published 17 September 2026.

**Which products and versions are affected?** github.com/siderolabs/omni (Go) SEMVER:introduced=0,fixed=1.6.6, SEMVER:introduced=0,fixed=1.6.6,introduced=1.7.0,fixed=1.7.3; Sidero Labs Omni < 1.6.6, >= 1.7.0, < 1.7.3.

**Is there a fix for CVE-2026-45723?** Yes. github.com/siderolabs/omni (Go): upgrade to 1.6.6, 1.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45723 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-45723?** Check whether you run github.com/siderolabs/omni (Go) or Sidero Labs Omni at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/siderolabs/omni (Go): upgrade to 1.6.6, 1.7.3 or later

  ```sh
  go get github.com/siderolabs/omni@v1.7.3
  ```


## Technical details

A path traversal vulnerability exists in the `managementServer.CreateSchematic` function within `internal/backend/grpc/schematics.go`. The `TalosVersion` field is passed without sanitization to `imageFactoryClient.OverlaysVersions`, where it is used to construct a URL path. Because `url.URL.JoinPath` resolves `../` sequences, an authenticated Operator can traverse the API path on the configured image-factory server. This allows for Server-Side Request Forgery (SSRF) limited to the image-factory host, where error responses from unintended endpoints are reflected back to the user, potentially leaking internal diagnostics. The issue is fixed in versions 1.6.6 and 1.7.3.

## Affected products

- Sidero Labs Omni < 1.6.6, >= 1.7.0, < 1.7.3

## Identifiers

- CVE-2026-45723
- GHSA-c66c-vq6w-fvh5
- GO-2026-5316

## Timeline

- 2026-06-05: disclosed
- 2026-06-05: patched
- 2026-06-05: advisory

## References

- [https://api.github.com/users/bugbunny-research](https://api.github.com/users/bugbunny-research)
- [https://github.com/bugbunny-research](https://github.com/bugbunny-research)
- [https://api.github.com/users/bugbunny-research/gists%7B/gist_id%7D](https://api.github.com/users/bugbunny-research/gists%7B/gist_id%7D)
- [https://api.github.com/users/bugbunny-research/repos](https://api.github.com/users/bugbunny-research/repos)
- [https://avatars.githubusercontent.com/u/262839898?v=4](https://avatars.githubusercontent.com/u/262839898?v=4)
- [https://api.github.com/users/bugbunny-research/events%7B/privacy%7D](https://api.github.com/users/bugbunny-research/events%7B/privacy%7D)

## Related threats

- [Sidero Labs Omni information disclosure in ResourceService](https://junglewise.ai/threats/cve-2026-45726-sidero-labs-omni-information-disclosure-in-resourceservice)
- [Sidero Labs Omni TOCTOU race condition in SAML session token handling](https://junglewise.ai/threats/cve-2026-45720-sidero-labs-omni-toctou-race-condition-in-saml-session-token)
- [GO-2025-3979 - Omni Wireguard SideroLink potential escape in github.com/siderolabs/omni](https://junglewise.ai/threats/cve-2025-59824-omni-wireguard-siderolink-potential-escape)
- [GO-2025-4022 - Omni vulnerable to information leak via API in github.com/siderolabs/omni](https://junglewise.ai/threats/cve-2025-61688-omni-vulnerable-to-information-leak-via-api)
- [GO-2025-4021 - Omni is Vulnerable to DoS via Empty Create/Update Resource Requests in github.com/siderolabs/omni](https://junglewise.ai/threats/cve-2025-59836-omni-is-vulnerable-to-dos-via-empty-create-update-resource)