CVE-2026-45720

Omni (by Sidero Labs), a platform for managing Kubernetes on bare metal, VMs, or cloud, contains a TOCTOU race condition in SAML.getSession (internal/pkg/auth/interceptor/saml.go). The Used flag on a SAMLAssertion is checked and marked in two separate non-atomic operations, allowing concurrent re...

CVE-2026-45720 Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured...

GO-2026-5160 Omni has a TOCTOU race condition that allows multiple concurrent uses of a single-use SAML session token in github.com/siderolabs/omni

Omni has a TOCTOU race condition that allows multiple concurrent uses of a single-use SAML session token in github.com/siderolabs/omni...