CVE-2026-45726
Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in internal/backend/runtime/omni/state_access.go allow an authenticated user with the Reader role to retrieve the resource through ResourceService if the importing actor has not rotated those secrets, exposing Kubernetes, Talos, and etcd CA private keys plus the service-account key. The Kubernetes CA private key permits certificate signing for privileged identities such as system:masters and provides control of the imported cluster outside Omni's authorization boundary, including its workloads, credentials, and secrets. This issue is fixed in versions 1.6.6 and 1.7.3.
Timeline
ID reserved
By GitHub_M
- 4 months later
· 4 months later
Published
- 4 days later
· 4 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High7.6 | CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
| NVDNVD · Deferred | 3.1 | High7.6 | CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.14% · top 97% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.6.
Weakness
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)All about CWE-200 and its CVEs
- CWE-522: Insufficiently Protected Credentials (opens in a new tab)All about CWE-522 and its CVEs
- CWE-732: Incorrect Permission Assignment for Critical Resource (opens in a new tab)All about CWE-732 and its CVEs
Affected products
- affected >= 1.3.0, < 1.6.6
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gogithub.com/siderolabs/omniGHSA-wv8c-6mx2-xf4j (opens in a new tab)
References (7)
- https://github.com/siderolabs/omni/security/advisories/GHSA-wv8c-6mx2-xf4j (opens in a new tab)x_refsource_CONFIRM
- https://github.com/siderolabs/omni/pull/2807 (opens in a new tab)x_refsource_MISC
- https://github.com/siderolabs/omni/commit/25fa9e141ee00285e70210ed40d11e4e457c871d (opens in a new tab)x_refsource_MISC
- https://github.com/siderolabs/omni/commit/a224cb020f3aaca2bc21c3e32a38eb4a37e531e8 (opens in a new tab)x_refsource_MISC
- https://github.com/siderolabs/omni/commit/b8ca100c4539ea83f0ac2e53dcd523e6e5b68111 (opens in a new tab)x_refsource_MISC
- https://github.com/siderolabs/omni/releases/tag/v1.6.6 (opens in a new tab)x_refsource_MISC
- https://github.com/siderolabs/omni/releases/tag/v1.7.3 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-wv8c-6mx2-xf4j (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-45726)Record last updated .