{"id":"CVE-2026-45723","aliases":["GHSA-c66c-vq6w-fvh5","GO-2026-5316"],"url":"https://o3.security/vulnerability/CVE-2026-45723","summary":"Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic","details":"## Summary\n\n`managementServer.CreateSchematic` (`internal/backend/grpc/schematics.go`) passes the caller-controlled `TalosVersion` field directly to `imageFactoryClient.OverlaysVersions`, which embeds it verbatim into a `fmt.Sprintf(\"/version/%s/overlays/official\", talosVersion)` path template. `url.URL.JoinPath` resolves any `../` sequences in that path, allowing an authenticated Operator to rewrite the URL path and force Omni to issue HTTP GET requests to unintended paths on the configured image-factory server. Error body content from those unintended endpoints is returned to the caller.\n\n## Severity\n\n- **Attack Vector:** Network: exploited via the gRPC `CreateSchematic` API endpoint.\n- **Attack Complexity:** Low: once the attacker holds an Operator credential and has identified a media ID with an overlay, exploitation is a single API call.\n- **Privileges Required:** High: `role.Operator` is required, which has administrative capabilities on Omni.\n- **User Interaction:** None.\n- **Scope:** Unchanged: the traversal is constrained to the configured image-factory host; the attacker cannot redirect Omni to an arbitrary external server.\n- **Confidentiality Impact:** Low: error body content from unintended image-factory endpoints is reflected back to the operator, potentially leaking server-internal information.\n- **Integrity Impact:** None: only HTTP GET requests are issued; no write operations are performed.\n- **Availability Impact:** None.\n\n## Impact\n\n- **Same-host path traversal**: An authenticated Operator can force Omni to issue GET requests to arbitrary URL paths on the configured image-factory server, bypassing the intended versioned overlay API structure.\n- **Error-body disclosure**: HTTP error responses from unintended image-factory endpoints are reflected back to the operator, potentially leaking server-internal diagnostics or sensitive path content.\n- **Internal network probing**: In deployments using a private image-factory instance on an internal network, the attacker can probe endpoint existence and partial responses through error-text differences.\n- **Depth control**: By varying the number of `../` prefixes in `talosVersion`, the attacker can reach any path hierarchy on the image-factory host.\n\n## Credit\nThis vulnerability was discovered and reported by [bugbunny.ai](https://bugbunny.ai).","published":"2026-09-17T19:39:28.303Z","modified":"2026-09-25T03:31:02.873260902Z","cvss":{"score":2.7,"severity":"LOW","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"github.com/siderolabs/omni","fixedVersion":"1.6.6"},{"ecosystem":"Go","name":"github.com/siderolabs/omni","fixedVersion":"1.7.3"}],"fix":{"url":"https://github.com/siderolabs/omni/commit/13c3f289789842e1fd954d98babb34b94eea1192","label":"siderolabs/omni@13c3f28"},"references":[{"type":"WEB","url":"https://github.com/siderolabs/omni/releases/tag/v1.6.6"},{"type":"WEB","url":"https://github.com/siderolabs/omni/releases/tag/v1.7.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45723.json"},{"type":"ADVISORY","url":"https://github.com/siderolabs/omni/security/advisories/GHSA-c66c-vq6w-fvh5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45723"},{"type":"FIX","url":"https://github.com/siderolabs/omni/commit/13c3f289789842e1fd954d98babb34b94eea1192"},{"type":"FIX","url":"https://github.com/siderolabs/omni/commit/3e69e80802624bf322f16aa499d5eafca16d0025"},{"type":"FIX","url":"https://github.com/siderolabs/omni/commit/9426c2cabccaa1d442bc8ebf28c16cae2d7c6ff7"},{"type":"FIX","url":"https://github.com/siderolabs/omni/pull/2817"},{"type":"PACKAGE","url":"https://github.com/siderolabs/omni"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-25T03:31:02.873260902Z"}}