Sidero Omni: unauthenticated empty resource request panics the Omni management service

Impact

Omni is the management plane that provisions and manages Talos/Kubernetes clusters on bare metal, which in a GPU fleet is the service operators use to image, join and reconfigure nodes. An unauthenticated request with an empty Metadata field reaches isSensitiveSpec, which dereferences resource.Metadata.Version and segfaults the server. Anyone who can open the Omni API port can therefore crash the service at will and keep it down, which does not touch running GPU workloads but blocks node provisioning, cluster reconfiguration and recovery actions for as long as it continues. The failure is availability-only per the advisory - no indication of data disclosure or cluster takeover.

Who can reach it

Anyone able to reach the Omni API endpoint over the network. No authentication and no credentials required, so exposure depends entirely on whether the Omni endpoint is restricted to a management network.

What to do

Upgrade Omni to 1.1.5 (or 1.0.2 on the 1.0 line) and restart the Omni service; the fix is a nil check in the resource service. No node drains or reboots are needed - managed clusters and GPU workloads keep running through the restart. Until the upgrade lands, restrict the Omni API to the management network.

References

Related entries

• Sidero Labs Omni: API discloses sensitive information to unauthenticated callersCVE-2025-61688 · Sidero Labs Omni (management API)High
• Apache DolphinScheduler: exposed management endpoints leak database credentials to unauthenticated callersCVE-2025-62188 · Apache DolphinScheduler 3.1.x (exposed Spring Boot management endpoints)High
• Jenkins SAML Plugin: no replay cache lets a captured SAML response be reused to log in as that userCVE-2025-64131 · Jenkins SAML Plugin (SAML response replay cache)High
• Apache Airflow: pre-3.2 deployments lack the isolation guarantees operators assumed, per clarified security modelCVE-2025-66236 · Apache Airflow (workload isolation and JWT token authentication, deployments before 3.2.0)High
• IBM Storage Scale GUI (hardcoded inter-node token): A hardcoded token in the Storage Scale GUI source, usedCVE-2026-13460 · IBM Storage Scale GUI (hardcoded inter-node token)High
• Performance Co-Pilot: signed integer overflow in __pmGetPDU permanently blinds the collector daemonCVE-2026-16529 · Performance Co-Pilot pmcd/PMAPI (__pmGetPDU PDU length handling)High