CVE-2026-45720 Details
Description
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The attacker can invoke SAML-protected gRPC endpoints, use ConfirmPublicKey to create multiple persistent credentials tied to the victim, and generate audit entries attributed to the victim, with the resulting access potentially affecting confidentiality, integrity, and availability according to the victim's privileges. This issue is fixed in versions 1.6.6 and 1.7.3.
A vulnerability exists in Sidero Labs Omni versions prior to 1.6.6 and from 1.7.0 to 1.7.3, where the SAML authentication process is not properly synchronized. The issue arises in the 'getSession' method of the SAML interceptor, which handles session tokens. This method checks the 'Used' status of a SAML assertion and marks it as used, but these operations are not atomic. As a result, an attacker can exploit this by sending concurrent requests with the same session token, both of which can be authenticated as the original token owner. This flaw allows access to SAML-protected gRPC endpoints, the ability to create multiple persistent credentials under the victim's identity, and generates audit log entries attributed to the victim, potentially disrupting services based on the victim's privileges.
Users can upgrade to Omni versions 1.6.6 or 1.7.3, both of which include the necessary fix for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/siderolabs/omni/commit/272d3f4dd00e778b39fde09afde35575fe13ef13 | [email protected] | Source CodeVendor |
| https://github.com/siderolabs/omni/commit/4c4c1e2d8226914f26774a309a91595f168ee921 | [email protected] | Source CodeVendor |
| https://github.com/siderolabs/omni/commit/ced79da6c032d2103803eb53343d0916cc957d2a | [email protected] | Source CodeVendor |
| https://github.com/siderolabs/omni/pull/2816 | [email protected] | Issue TrackingVendor |
| https://github.com/siderolabs/omni/releases/tag/v1.6.6 | [email protected] | Release NotesVendor |
| https://github.com/siderolabs/omni/releases/tag/v1.7.3 | [email protected] | Release NotesVendor |
| https://github.com/siderolabs/omni/security/advisories/GHSA-5x9f-6vg5-qg4m | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-294 | Authentication Bypass by Capture-replay | [email protected] |
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Sidero Labs Omni | < 1.6.6 (semver) >= 1.7.0, < 1.7.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2026 | New CVE Received | [email protected] |