Is CVE-2026-45726 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45726 being exploited in the wild.

How severe is CVE-2026-45726?

High severity, with a CVSS score of 7.6, published 17 September 2026.

Which products and versions are affected?

github.com/siderolabs/omni (Go) SEMVER:introduced=1.3.0,fixed=1.6.6, SEMVER:introduced=1.3.0,fixed=1.6.6,introduced=1.7.0,fixed=1.7.3; Sidero Labs Omni >= 1.3.0, = 1.7.0, < 1.7.3.

Is there a fix for CVE-2026-45726?

Yes. github.com/siderolabs/omni (Go): upgrade to 1.6.6, 1.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45726 attacked?

It is attacked from the adjacent network, in a hosted service.

Am I affected by CVE-2026-45726?

Check whether you run github.com/siderolabs/omni (Go) or Sidero Labs Omni at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45726: Sidero Labs Omni information disclosure in ResourceService

Q: Is there a fix for CVE-2026-45726?

Yes. github.com/siderolabs/omni (Go): upgrade to 1.6.6, 1.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45726 attacked?

It is attacked from the adjacent network, in a hosted service.

Q: Am I affected by CVE-2026-45726?

Check whether you run github.com/siderolabs/omni (Go) or Sidero Labs Omni at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45726 · Severity: high · CVSS 7.6 · Published 2026-09-17

Sidero Labs Omni, a management platform for Kubernetes clusters, contains a flaw where users with low-level 'Reader' permissions can access sensitive security keys for imported clusters. If an attacker gains these keys, they can bypass Omni's security controls to take full control of the underlying Kubernetes infrastructure, potentially leading to data theft or service disruption. This issue specifically affects clusters that have been imported into Omni but have not yet had their security credentials rotated.

Technologies: github.com/siderolabs/omni (Go), Sidero Labs Omni. Vendors: Go, Sidero Labs.

Quick answers

Is CVE-2026-45726 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45726 being exploited in the wild.
How severe is CVE-2026-45726?: High severity, with a CVSS score of 7.6, published 17 September 2026.
Which products and versions are affected?: github.com/siderolabs/omni (Go) SEMVER:introduced=1.3.0,fixed=1.6.6, SEMVER:introduced=1.3.0,fixed=1.6.6,introduced=1.7.0,fixed=1.7.3; Sidero Labs Omni >= 1.3.0, < 1.6.6; >= 1.7.0, < 1.7.3.
Is there a fix for CVE-2026-45726?: Yes. github.com/siderolabs/omni (Go): upgrade to 1.6.6, 1.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45726 attacked?: It is attacked from the adjacent network, in a hosted service.
Am I affected by CVE-2026-45726?: Check whether you run github.com/siderolabs/omni (Go) or Sidero Labs Omni at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/siderolabs/omni (Go): upgrade to 1.6.6, 1.7.3 or later
```
go get github.com/siderolabs/omni@v1.7.3
```

Technical details

A vulnerability in Sidero Labs Omni's ResourceService allows authenticated users with the 'Reader' role to access the 'ImportedClusterSecrets' resource. This resource contains the full CA secrets bundle (Kubernetes, Talos, and etcd) for imported standalone clusters. An attacker with these keys can sign certificates for any user or group (e.g., system:masters), gaining cluster-admin privileges outside of Omni's control plane. The attack requires the attacker to be on an adjacent network to reach the cluster APIs and has high complexity as it requires knowledge of Omni's internal resource structures. The issue is patched in versions 1.6.6 and 1.7.3.

Affected products

Sidero Labs Omni >= 1.3.0, < 1.6.6; >= 1.7.0, < 1.7.3

Identifiers

CVE-2026-45726
GHSA-wv8c-6mx2-xf4j
GO-2026-5725

Timeline

2026-06-05: disclosed
2026-06-05: advisory
2026-06-05: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.