CVE-2026-45723

Omni (SideroLabs), a Kubernetes management platform, is vulnerable to same-host path traversal via the managementServer.CreateSchematic gRPC endpoint. The caller-controlled TalosVersion field is passed unsanitized to imageFactoryClient.OverlaysVersions, where url.URL.JoinPath resolves ../ sequenc...