GitHub Advisoryadvisory · Go

GHSA-77r9-w39m-9xh5 Omni vulnerable to information leak via API

HIGH Published 2025-10-13 Modified 2025-11-05 Official page ↗

Aliases: CVE-2025-61688
Ecosystem: Go
Packages: github.com/siderolabs/omni
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Weaknesses: CWE-200
Reviewed: 2025-10-13

Affected packages

• Go github.com/siderolabs/omni: >= 1.1.0-beta.0, < 1.1.5 → fixed in 1.1.5 • Go github.com/siderolabs/omni: < 1.0.2 → fixed in 1.0.2

Description

Impact Omni might leak sensitive information via an API. Patches v1.1.5, v1.0.2 and v1.2.0 contain the patch. Workarounds None. References None.

Related

Alias · CVE (1)

CVE-2025-61688 Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. vulnerability

Weakness · CWE (1)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References