CVE-2026-45726

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in internal/backend/runtime/omni/state_access.go allow an authenticated user with the Reader role to retrieve the resource through ResourceService if the importing actor has not rotated those secrets, exposing Kubernetes, Talos, and etcd CA private keys plus the service-account key. The Kubernetes CA private key permits certificate signing for privileged identities such as system:masters and provides control of the imported cluster outside Omni's authorization boundary, including its workloads, credentials, and secrets. This issue is fixed in versions 1.6.6 and 1.7.3.

• CWE-200
• CWE-522
• CWE-732

• https://github.com/siderolabs/omni/commit/25fa9e141ee00285e70210ed40d11e4e457c871d
• https://github.com/siderolabs/omni/commit/a224cb020f3aaca2bc21c3e32a38eb4a37e531e8
• https://github.com/siderolabs/omni/commit/b8ca100c4539ea83f0ac2e53dcd523e6e5b68111
• https://github.com/siderolabs/omni/pull/2807
• https://github.com/siderolabs/omni/releases/tag/v1.6.6
• https://github.com/siderolabs/omni/releases/tag/v1.7.3
• https://github.com/siderolabs/omni/security/advisories/GHSA-wv8c-6mx2-xf4j

Published

Sep 17, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4572A weakness has been identified in SourceCodester Sales and I…6.5
• CVE-2026-45720Omni manages Kubernetes on bare metal, virtual machines, or …7
• CVE-2026-45721Algernon is a small self-contained pure-Go web server. Prior…9
• CVE-2026-45722Nextcloud is an open source content collaboration platform. …7.1
• CVE-2026-45723Omni manages Kubernetes on bare metal, virtual machines, or …2.7
• CVE-2026-45725compliance-trestle is a tooling platform for managing compli…7.1
• CVE-2026-45727CloakBrowser is a tool to bypass bot detection tests. Prior …8.8
• CVE-2026-45728Algernon is a small self-contained pure-Go web server. Prior…7.5
• CVE-2026-45729Thor Vector Graphics (ThorVG) is a production-ready vector g…4.3
• CVE-2026-4573A security vulnerability has been detected in SourceCodester…6.3
• CVE-2026-45730Nuclio is a "Serverless" framework for Real-Time Events and …8.3
• CVE-2026-45731WWBN AVideo is an open source video platform. In 29.0 and ea…4.9