Omni vulnerable to information leak via API

HOCH 7.5CVE-2025-61688 · GHSA-77r9-w39m-9xh5 · GO-2025-4022 · Published 13/10/2025 · updated 08/10/2026

Kurz gesagt

CVE-2025-61688 ist eine Schwachstelle (HOCH (CVSS 7.5)) in github.com/siderolabs/omni, omni (siderolabs).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.31%, höher als bei 24.2% aller Schwachstellen.
Abhilfe: auf 1.1.5, 1.0.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
github.com/siderolabs/omni Go	`≥ 1.1.0-beta.0, < 1.1.5< 1.0.2`	`1.1.51.0.2`
omni siderolabs	`≥ 1.1.0, < 1.1.5< 1.0.2`	`1.1.51.0.2`

Omni might leak sensitive information via an API.

v1.1.5, v1.0.2 and v1.2.0 contain the patch.

None.

None.

NVD description

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, Omni might leak sensitive information via an API.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≥ 1.1.0-beta.0, < 1.1.5< 1.0.2

1.1.51.0.2

≥ 1.1.0, < 1.1.5< 1.0.2

1.1.51.0.2

Description

Omni might leak sensitive information via an API.

v1.1.5, v1.0.2 and v1.2.0 contain the patch.

None.

None.

NVD description

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, Omni might leak sensitive information via an API.

Weitere Schwachstellen in github.com/siderolabs/omni

Alle anzeigen →