GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-45720

Vulnerability from fkie_nvd - Published: 2026-09-17 20:16 - Updated: 2026-09-17 21:17
Severity
7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The attacker can invoke SAML-protected gRPC endpoints, use ConfirmPublicKey to create multiple persistent credentials tied to the victim, and generate audit entries attributed to the victim, with the resulting access potentially affecting confidentiality, integrity, and availability according to the victim's privileges. This issue is fixed in versions 1.6.6 and 1.7.3.
References
security-advisories@github.comhttps://github.com/siderolabs/omni/commit/272d3f4dd00e778b39fde09afde35575fe13ef13
security-advisories@github.comhttps://github.com/siderolabs/omni/commit/4c4c1e2d8226914f26774a309a91595f168ee921
security-advisories@github.comhttps://github.com/siderolabs/omni/commit/ced79da6c032d2103803eb53343d0916cc957d2a
security-advisories@github.comhttps://github.com/siderolabs/omni/pull/2816
security-advisories@github.comhttps://github.com/siderolabs/omni/releases/tag/v1.6.6
security-advisories@github.comhttps://github.com/siderolabs/omni/releases/tag/v1.7.3
security-advisories@github.comhttps://github.com/siderolabs/omni/security/advisories/GHSA-5x9f-6vg5-qg4m
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "omni",
          "vendor": "siderolabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.6.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.7.0, \u003c 1.7.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The attacker can invoke SAML-protected gRPC endpoints, use ConfirmPublicKey to create multiple persistent credentials tied to the victim, and generate audit entries attributed to the victim, with the resulting access potentially affecting confidentiality, integrity, and availability according to the victim\u0027s privileges. This issue is fixed in versions 1.6.6 and 1.7.3."
    }
  ],
  "id": "CVE-2026-45720",
  "lastModified": "2026-09-17T21:17:12.743",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45720",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-17T20:21:30.412238Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-17T20:16:49.190",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/omni/commit/272d3f4dd00e778b39fde09afde35575fe13ef13"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/omni/commit/4c4c1e2d8226914f26774a309a91595f168ee921"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/omni/commit/ced79da6c032d2103803eb53343d0916cc957d2a"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/omni/pull/2816"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/omni/releases/tag/v1.6.6"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/omni/releases/tag/v1.7.3"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/siderolabs/omni/security/advisories/GHSA-5x9f-6vg5-qg4m"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-294"
        },
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.