- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 6 · 3 high, 1 medium, 2 low
- Registry
- pkg.go.dev
Advisories 6
- CVE-2026-45720High 7.0
Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token
Affected: fixed in 1.6.6; from 1.7.0, fixed in 1.7.3; fixed in 1.6.6; from 1.7.0, fixed in 1.7.3.
- CVE-2026-45723Low 2.7
Omni: Operator can traverse image-factory API paths via unsanitized `talos_version` in CreateSchematic
Affected: fixed in 1.6.6; from 1.7.0, fixed in 1.7.3; fixed in 1.6.6; from 1.7.0, fixed in 1.7.3.
- CVE-2026-45726High 7.6
Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService
Affected: from 1.3.0, fixed in 1.6.6; from 1.7.0, fixed in 1.7.3; from 1.3.0, fixed in 1.6.6; from 1.7.0, fixed in 1.7.3.
- CVE-2025-61688High 8.6
Omni leaks information via the API
Affected: from 1.1.0-beta.0, fixed in 1.1.5; fixed in 1.0.2; fixed in 1.0.2; from 1.1.0-beta.0, fixed in 1.1.5.
- CVE-2025-59836Medium 5.3
Omni is Vulnerable to DoS via Empty Create/Update Resource Requests
Affected: from 1.1.0-beta.0, fixed in 1.1.5; fixed in 1.0.2; fixed in 1.0.2; from 1.1.0-beta.0, fixed in 1.1.5.
- CVE-2025-59824Low 0.5
Omni Wireguard SideroLink potential escape
Affected: fixed in 0.48.0.