CVE-2025-59824

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to version 0.48.0, Omni Wireguard SideroLink has the potential to escape. Omni and each Talos machine establish a peer-to-peer (P2P) SideroLink connection using WireGuard to mutually authenticate and authorize access. The WireGuard interface on Omni is configured to ensure that the source IP address of an incoming packet matches the IPv6 address assigned to the Talos peer. However, it performs no validation on the packet's destination address. The Talos end of the SideroLink connection cannot be considered a trusted environment. Workloads running on Kubernetes, especially those configured with host networking, could gain direct access to this link. Therefore, a malicious workload could theoretically send arbitrary packets over the SideroLink interface. This issue has been patched in version 0.48.0.

• CWE-863

• https://github.com/siderolabs/omni/commit/a5efd816a239e6c9e5ea7c0d43c02c04504d7b60Patch
• https://github.com/siderolabs/omni/security/advisories/GHSA-hqrf-67pm-wgfqPatch, Vendor Advisory

Published

Sep 24, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-59819This vulnerability allows authenticated attackers to read an…6.5
• CVE-2025-5982An issue has been discovered in GitLab EE affecting all vers…7.5
• CVE-2025-59820In KDE Krita before 5.2.13, loading a manipulated TGA file c…6.7
• CVE-2025-59821DNN (formerly DotNetNuke) is an open-source web content mana…6.1
• CVE-2025-59822Http4s is a Scala interface for HTTP services. In versions f…7.5
• CVE-2025-59823Project Gardener implements the automated management and ope…9.9
• CVE-2025-59825astral-tokio-tar is a tar archive reading/writing library fo…6.1
• CVE-2025-59826Flag Forge is a Capture The Flag (CTF) platform. In version …7.6
• CVE-2025-59827Flag Forge is a Capture The Flag (CTF) platform. In version …9.8
• CVE-2025-59828Claude Code is an agentic coding tool. Prior to Claude Code …9.8
• CVE-2025-59829Claude Code is an agentic coding tool. Versions below 1.0.12…6.5
• CVE-2025-5983The Meta Tag Manager WordPress plugin before 3.3 does not re…6.5