CVE-2026-45723

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An...

EUVD-2026-82402

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An...

CVE-2026-45723

Omni (SideroLabs), a Kubernetes management platform, is vulnerable to same-host path traversal via the managementServer.CreateSchematic gRPC endpoint. The caller-controlled TalosVersion field is passed unsanitized to imageFactoryClient.OverlaysVersions, where url.URL.JoinPath resolves ../ sequenc...