Sidero Labs Omni: API discloses sensitive information to unauthenticated callers

Impact

Omni is the management plane that provisions and controls Talos Linux Kubernetes clusters, including bare-metal GPU nodes. The advisory states that an API path can leak sensitive information with no authentication required. For an operator, anything Omni holds is cluster-level material - node enrolment data, cluster configuration, credentials used to join machines - so a leak here is a leak about every cluster that Omni manages, not about one workload. The record does not say which data is exposed, so treat the blast radius as the whole Omni instance until the vendor advisory narrows it.

Who can reach it

Anyone who can reach the Omni API over the network. No authentication and no user interaction (AV:N/PR:N/UI:N). If Omni is published beyond the management network, this is internet-reachable.

What to do

Upgrade Omni to 1.1.5 (1.1.x) or 1.0.2 (1.0.x) and restart the service. This is a control-plane component, not a per-node agent: no GPU node needs draining or rebooting, and managed clusters keep running through the upgrade. Until the upgrade lands, restrict the Omni API to the management network. If the instance was exposed, rotate any cluster join credentials Omni holds, since the record does not rule out credential disclosure.

References

Related entries

• Apache DolphinScheduler: exposed management endpoints leak database credentials to unauthenticated callersCVE-2025-62188 · Apache DolphinScheduler 3.1.x (exposed Spring Boot management endpoints)High
• Jenkins SAML Plugin: no replay cache lets a captured SAML response be reused to log in as that userCVE-2025-64131 · Jenkins SAML Plugin (SAML response replay cache)High
• Apache Airflow: pre-3.2 deployments lack the isolation guarantees operators assumed, per clarified security modelCVE-2025-66236 · Apache Airflow (workload isolation and JWT token authentication, deployments before 3.2.0)High
• IBM Storage Scale GUI (hardcoded inter-node token): A hardcoded token in the Storage Scale GUI source, usedCVE-2026-13460 · IBM Storage Scale GUI (hardcoded inter-node token)High
• Performance Co-Pilot: signed integer overflow in __pmGetPDU permanently blinds the collector daemonCVE-2026-16529 · Performance Co-Pilot pmcd/PMAPI (__pmGetPDU PDU length handling)High
• Automated Logic WebCTRL / i-Vu server and controllers, BACnet transport trust: This is the vendor formally concedingCVE-2026-32666 · Automated Logic WebCTRL / i-Vu server and controllers, BACnet transport trustHigh