2.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45723

CVE-2026-45723: Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic

Summary

managementServer.CreateSchematic (internal/backend/grpc/schematics.go) passes the caller-controlled TalosVersion field directly to imageFactoryClient.OverlaysVersions, which embeds it verbatim into a fmt.Sprintf("/version/%s/overlays/official", talosVersion) path template. url.URL.JoinPath resolves any ../ sequences in that path, allowing an authenticated Operator to rewrite the URL path and force Omni to issue HTTP GET requests to unintended paths on the configured image-factory server. Error body content from those unintended endpoints is returned to the caller.

Severity

Attack Vector: Network: exploited via the gRPC CreateSchematic API endpoint.
Attack Complexity: Low: once the attacker holds an Operator credential and has identified a media ID with an overlay, exploitation is a single API call.
Privileges Required: High: role.Operator is required, which has administrative capabilities on Omni.
User Interaction: None.
Scope: Unchanged: the traversal is constrained to the configured image-factory host; the attacker cannot redirect Omni to an arbitrary external server.
Confidentiality Impact: Low: error body content from unintended image-factory endpoints is reflected back to the operator, potentially leaking server-internal information.
Integrity Impact: None: only HTTP GET requests are issued; no write operations are performed.
Availability Impact: None.

Impact

Same-host path traversal: An authenticated Operator can force Omni to issue GET requests to arbitrary URL paths on the configured image-factory server, bypassing the intended versioned overlay API structure.
Error-body disclosure: HTTP error responses from unintended image-factory endpoints are reflected back to the operator, potentially leaking server-internal diagnostics or sensitive path content.
Internal network probing: In deployments using a private image-factory instance on an internal network, the attacker can probe endpoint existence and partial responses through error-text differences.
Depth control: By varying the number of ../ prefixes in talosVersion, the attacker can reach any path hierarchy on the image-factory host.

Credit

This vulnerability was discovered and reported by bugbunny.ai.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45723

CVE-2026-45723:

2.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/siderolabs/omni	go	< 1.6.6	1.6.6
github.com/siderolabs/omni	go	>= 1.7.0, < 1.7.3	1.7.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal weakness in the CreateSchematic gRPC API endpoint. An authenticated operator can supply a malicious TalosVersion string containing path traversal sequences (e.g., ../). This input is used to construct a URL to an image-factory server, allowing the attacker to make GET requests to arbitrary paths on that server.

The analysis of the provided patches confirms this. The commits 3e69e80802624bf322f16aa499d5eafca16d0025 and 9426c2cabccaa1d442bc8ebf28c16cae2d7c6ff7 introduce input validation in the getOverlay function, which is called by CreateSchematic. The TalosVersion is now parsed as a semantic version, which effectively mitigates the path traversal attack by rejecting invalid version strings. The vulnerable functions are managementServer.CreateSchematic, which is the public-facing API endpoint, and managementServer.getOverlay, which contains the logic that constructs the vulnerable URL path.

Vulnerable functions

managementServer.CreateSchematic

internal/backend/grpc/schematics.go

This function is the gRPC method that receives the unsanitized `TalosVersion` from the user. It then calls `getOverlay`, which uses this version to construct a URL, leading to a path traversal vulnerability.

managementServer.getOverlay

internal/backend/grpc/schematics.go

This function is called by `CreateSchematic` and, prior to the patch, it used the `TalosVersion` parameter directly to construct a URL path without sanitization. The patch adds validation by parsing `TalosVersion` as a semantic version, thus preventing path traversal.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.