https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 13:20:49 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-45723 <p>Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, and url.URL.JoinPath normalizes them into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics while preventing redirection to another host or write requests. This issue is fixed in versions 1.6.6 and 1.7.3.</p> <p>Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, and url.URL.JoinPath normalizes them into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics while preventing redirection to another host or write requests. This issue is fixed in versions 1.6.6 and 1.7.3.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-45723 https://vulnerability.circl.lu/vuln/ghsa-c66c-vq6w-fvh5 <p><strong>Affected:</strong> Go: github.com/siderolabs/omni</p> <p>## Summary</p> <p>`managementServer.CreateSchematic` (`internal/backend/grpc/schematics.go`) passes the caller-controlled `TalosVersion` field directly to `imageFactoryClient.OverlaysVersions`, which embeds it verbatim into a `fmt.Sprintf(&#34;/version/%s/overlays/official&#34;, talosVersion)` path template. `url.URL.JoinPath` resolves any `../` sequences in that path, allowing an authenticated Operator to rewrite the URL path and force Omni to issue HTTP GET requests to unintended paths on the configured image-factory server. Error body content from those unintended endpoints is returned to the caller.</p> <p>## Severity</p> <p>- **Attack Vector:** Network: exploited via the gRPC `CreateSchematic` API endpoint. - **Attack Complexity:** Low: once the attacker holds an Operator credential and has identified a media ID with an overlay, exploitation is a single API call. - **Privileges Required:** High: `role.Operator` is required, which has administrative capabilities on Omni. - **User Interaction:** None. - **Scope:** Unchanged: the traversal is constrained to the configured image-factory host; the attacker cannot redirect Omni to an arbitrary external server. - **Confidentiality Impact:** Low: error body content from unintended image-factory endpoints is reflected back to the operator, potentially leaking server-internal information. - **Integrity Impact:** None: only HTTP GET requests are issued; no write operations are performed. - **Availability Impact:** None.</p> <p>## Impact</p> <p>- **Same-host path trave…</p> <p><strong>Affected:</strong> Go: github.com/siderolabs/omni</p> <p>## Summary</p> <p>`managementServer.CreateSchematic` (`internal/backend/grpc/schematics.go`) passes the caller-controlled `TalosVersion` field directly to `imageFactoryClient.OverlaysVersions`, which embeds it verbatim into a `fmt.Sprintf(&#34;/version/%s/overlays/official&#34;, talosVersion)` path template. `url.URL.JoinPath` resolves any `../` sequences in that path, allowing an authenticated Operator to rewrite the URL path and force Omni to issue HTTP GET requests to unintended paths on the configured image-factory server. Error body content from those unintended endpoints is returned to the caller.</p> <p>## Severity</p> <p>- **Attack Vector:** Network: exploited via the gRPC `CreateSchematic` API endpoint. - **Attack Complexity:** Low: once the attacker holds an Operator credential and has identified a media ID with an overlay, exploitation is a single API call. - **Privileges Required:** High: `role.Operator` is required, which has administrative capabilities on Omni. - **User Interaction:** None. - **Scope:** Unchanged: the traversal is constrained to the configured image-factory host; the attacker cannot redirect Omni to an arbitrary external server. - **Confidentiality Impact:** Low: error body content from unintended image-factory endpoints is reflected back to the operator, potentially leaking server-internal information. - **Integrity Impact:** None: only HTTP GET requests are issued; no write operations are performed. - **Availability Impact:** None.</p> <p>## Impact</p> <p>- **Same-host path trave…</p> https://vulnerability.circl.lu/vuln/ghsa-c66c-vq6w-fvh5