{"id":"CVE-2026-45723","summary":"Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic","details":"Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, and url.URL.JoinPath normalizes them into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics while preventing redirection to another host or write requests. This issue is fixed in versions 1.6.6 and 1.7.3.","aliases":["GHSA-c66c-vq6w-fvh5","GO-2026-5316"],"modified":"2026-09-19T11:30:15.662699382Z","published":"2026-09-17T19:39:28.303Z","related":["openSUSE-SU-2026:21483-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45723.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-20","CWE-209","CWE-22","CWE-441","CWE-918"]},"references":[{"type":"WEB","url":"https://github.com/siderolabs/omni/releases/tag/v1.6.6"},{"type":"WEB","url":"https://github.com/siderolabs/omni/releases/tag/v1.7.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45723.json"},{"type":"ADVISORY","url":"https://github.com/siderolabs/omni/security/advisories/GHSA-c66c-vq6w-fvh5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45723"},{"type":"FIX","url":"https://github.com/siderolabs/omni/commit/13c3f289789842e1fd954d98babb34b94eea1192"},{"type":"FIX","url":"https://github.com/siderolabs/omni/commit/3e69e80802624bf322f16aa499d5eafca16d0025"},{"type":"FIX","url":"https://github.com/siderolabs/omni/commit/9426c2cabccaa1d442bc8ebf28c16cae2d7c6ff7"},{"type":"FIX","url":"https://github.com/siderolabs/omni/pull/2817"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/siderolabs/omni","events":[{"introduced":"0"},{"introduced":"5e912b14ddad86d13d9c004a9774a875e9cee108"},{"fixed":"9769f9442e302e000401e351ffd6d6fb3671a5bf"},{"fixed":"e70a16e4a226aa2f98643dbed6664edc1a5e90e7"},{"fixed":"13c3f289789842e1fd954d98babb34b94eea1192"},{"fixed":"3e69e80802624bf322f16aa499d5eafca16d0025"},{"fixed":"9426c2cabccaa1d442bc8ebf28c16cae2d7c6ff7"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"1.6.6"},{"introduced":"1.7.0"},{"fixed":"1.7.3"}]}}],"versions":["v1.6.5","client/v1.6.5","v1.7.2","client/v1.7.2","v1.7.1","client/v1.7.1","v1.7.0","client/v1.7.0","v1.7.0-beta.0","client/v1.7.0-beta.0","v1.6.4","client/v1.6.4","v1.6.3","client/v1.6.3","v1.6.2","client/v1.6.2","v1.6.1","client/v1.6.1","v1.6.0","client/v1.6.0","v1.6.0-beta.3","client/v1.6.0-beta.3","v1.6.0-beta.2","client/v1.6.0-beta.2","v1.6.0-beta.1","client/v1.6.0-beta.1","v1.6.0-beta.0","client/v1.6.0-beta.0","v1.5.0-beta.2","client/v1.5.0-beta.2","v1.5.0-beta.1","client/v1.5.0-beta.1","v1.5.0-beta.0","v1.4.0-beta.1","client/v1.4.0-beta.1","v1.4.0-beta.0","client/v1.4.0-beta.0","v1.3.0-beta.1","client/v1.3.0-beta.1","v1.2.0-beta.3","client/v1.2.0-beta.3","v1.2.0-beta.2","client/v1.2.0-beta.2","v1.2.0-beta.1","client/v1.2.0-beta.1","v1.2.0-beta.0","client/v1.2.0-beta.0","v1.1.0-beta.0","v1.0.0-beta.1","v1.0.0-beta.0","v0.52.0-beta.0","v0.51.0-beta.2","v0.51.0-beta.1","client/v0.51.0-beta.1","v0.51.0-beta.0","client/v0.51.0-beta.0","v0.50.0-beta.0","v0.49.0-beta.0","v0.48.0-beta.0","client/v0.48.0-beta.0","v0.47.0-beta.1","v0.47.0-beta.0","v0.46.0-beta.0","v0.45.0-beta.0","v0.44.0-beta.0","v0.43.0","v0.43.0-beta.0","v0.42.0-beta.0","v0.41.0-beta.0","v0.40.0-beta.0","v0.39.0-beta.0","v0.38.0-beta.0","v0.37.0-beta.0","v0.36.0-beta.0","v0.35.0-beta.0","v0.34.0-beta.0","v0.33.0-beta.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45723.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}]}