CVE-2026-45723

Name of the Vulnerable Software and Affected Versions Omni (affected versions not specified)

Description An authenticated Operator can perform a same-host path traversal by exploiting the managementServer.CreateSchematic (internal/backend/grpc/schematics.go) function. The issue occurs because the TalosVersion variable is passed directly to imageFactoryClient.OverlaysVersions and embedded into a path template. Since url.URL.JoinPath resolves ../ sequences, an attacker can rewrite the URL path to force the system to issue HTTP GET requests to unintended paths on the configured image-factory server. This can lead to the disclosure of error body content from those endpoints, potentially leaking server-internal diagnostics or sensitive path content, and allowing for internal network probing of the image-factory instance.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.