# CVE-2026-45726: Sidero Labs Omni information disclosure in ResourceService

Source: https://junglewise.ai/threats/cve-2026-45726-sidero-labs-omni-information-disclosure-in-resourceservice  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-45726 · Severity: high · CVSS 7.6 · Published 2026-09-17

Sidero Labs Omni, a management platform for Kubernetes clusters, contains a flaw where users with low-level 'Reader' permissions can access sensitive security keys for imported clusters. If an attacker gains these keys, they can bypass Omni's security controls to take full control of the underlying Kubernetes infrastructure, potentially leading to data theft or service disruption. This issue specifically affects clusters that have been imported into Omni but have not yet had their security credentials rotated.

Technologies: [github.com/siderolabs/omni (Go)](https://junglewise.ai/threats/technologies/github-com-siderolabs-omni), [Sidero Labs Omni](https://junglewise.ai/threats/technologies/omni). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Sidero Labs](https://junglewise.ai/threats/vendors/sidero-labs).

## Quick answers

**Is CVE-2026-45726 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45726 being exploited in the wild.

**How severe is CVE-2026-45726?** High severity, with a CVSS score of 7.6, published 17 September 2026.

**Which products and versions are affected?** github.com/siderolabs/omni (Go) SEMVER:introduced=1.3.0,fixed=1.6.6, SEMVER:introduced=1.3.0,fixed=1.6.6,introduced=1.7.0,fixed=1.7.3; Sidero Labs Omni >= 1.3.0, < 1.6.6; >= 1.7.0, < 1.7.3.

**Is there a fix for CVE-2026-45726?** Yes. github.com/siderolabs/omni (Go): upgrade to 1.6.6, 1.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45726 attacked?** It is attacked from the adjacent network, in a hosted service.

**Am I affected by CVE-2026-45726?** Check whether you run github.com/siderolabs/omni (Go) or Sidero Labs Omni at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/siderolabs/omni (Go): upgrade to 1.6.6, 1.7.3 or later

  ```sh
  go get github.com/siderolabs/omni@v1.7.3
  ```


## Technical details

A vulnerability in Sidero Labs Omni's ResourceService allows authenticated users with the 'Reader' role to access the 'ImportedClusterSecrets' resource. This resource contains the full CA secrets bundle (Kubernetes, Talos, and etcd) for imported standalone clusters. An attacker with these keys can sign certificates for any user or group (e.g., system:masters), gaining cluster-admin privileges outside of Omni's control plane. The attack requires the attacker to be on an adjacent network to reach the cluster APIs and has high complexity as it requires knowledge of Omni's internal resource structures. The issue is patched in versions 1.6.6 and 1.7.3.

## Affected products

- Sidero Labs Omni >= 1.3.0, < 1.6.6; >= 1.7.0, < 1.7.3

## Identifiers

- CVE-2026-45726
- GHSA-wv8c-6mx2-xf4j
- GO-2026-5725

## Timeline

- 2026-06-05: disclosed
- 2026-06-05: advisory
- 2026-06-05: patched

## References

- [https://api.github.com/users/bugbunny-research](https://api.github.com/users/bugbunny-research)
- [https://github.com/bugbunny-research](https://github.com/bugbunny-research)
- [https://api.github.com/users/bugbunny-research/gists%7B/gist_id%7D](https://api.github.com/users/bugbunny-research/gists%7B/gist_id%7D)
- [https://api.github.com/users/bugbunny-research/repos](https://api.github.com/users/bugbunny-research/repos)
- [https://avatars.githubusercontent.com/u/262839898?v=4](https://avatars.githubusercontent.com/u/262839898?v=4)
- [https://api.github.com/users/bugbunny-research/events%7B/privacy%7D](https://api.github.com/users/bugbunny-research/events%7B/privacy%7D)

## Related threats

- [Sidero Labs Omni path traversal in CreateSchematic API](https://junglewise.ai/threats/cve-2026-45723-sidero-labs-omni-path-traversal-in-createschematic-api)
- [Sidero Labs Omni TOCTOU race condition in SAML session token handling](https://junglewise.ai/threats/cve-2026-45720-sidero-labs-omni-toctou-race-condition-in-saml-session-token)
- [GO-2025-3979 - Omni Wireguard SideroLink potential escape in github.com/siderolabs/omni](https://junglewise.ai/threats/cve-2025-59824-omni-wireguard-siderolink-potential-escape)
- [GO-2025-4022 - Omni vulnerable to information leak via API in github.com/siderolabs/omni](https://junglewise.ai/threats/cve-2025-61688-omni-vulnerable-to-information-leak-via-api)
- [GO-2025-4021 - Omni is Vulnerable to DoS via Empty Create/Update Resource Requests in github.com/siderolabs/omni](https://junglewise.ai/threats/cve-2025-59836-omni-is-vulnerable-to-dos-via-empty-create-update-resource)