siderolabs vulnerabilities

8 published CVEs name siderolabs among the affected products.

Critical 0High 4Medium 1Low 3Not scored 0

CVEs per yearBy the year they were published

CVE-2026-77564
Talos Linux: Support bundle does not redact registry credentials
siderolabs · talos
Low3.3
CVE-2026-45720
Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token
siderolabs · omni
High7.0
CVE-2026-45723
Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic
siderolabs · omni
Low2.7
CVE-2026-45726
Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService
siderolabs · omni
High7.6
CVE-2025-61688
Omni leaks information via the API
siderolabs · omni
High8.6
CVE-2025-59836
Omni is Vulnerable to DoS via Empty Create/Update Resource Requests
siderolabs · omni
Medium5.3
CVE-2025-59824
Omni Wireguard SideroLink potential escape
siderolabs · omni
Low0.5
CVE-2022-36103
Talos worker join token can be used to get elevated access level to the Talos API
siderolabs · talos
High7.2