Sidero Omni: SAML assertion replay race lets a captured saml-session token be redeemed more than once

Impact

Omni checks SAMLAssertion.Used and marks it used as two separate state operations, so concurrent requests carrying the same captured saml-session token can each see the assertion as unused. An attacker holding a captured token authenticates as the victim, calls SAML-protected gRPC endpoints, and - via ConfirmPublicKey - mints multiple persistent credentials tied to that identity, turning a one-shot replay into durable access. Omni is the management plane for bare-metal and VM Kubernetes clusters, so the access inherited is whatever the victim holds over cluster lifecycle, potentially including node provisioning and wipe. Audit entries are attributed to the victim, which also degrades the forensic record. Affects versions before 1.6.6 and 1.7.0 through 1.7.2.

Who can reach it

An attacker who has captured a victim's saml-session token (the CVSS vector records local access and user interaction) and can issue concurrent requests to the Omni API. No prior Omni account is needed.

What to do

Upgrade Omni to 1.6.6 or 1.7.3 and restart the Omni service. Afterwards, review ConfirmPublicKey-created credentials and revoke any public keys registered for users who did not add them, and treat audit-log entries from the exposure window as untrustworthy. Managed clusters keep running; only the management service restarts.

References

Related entries

• Redis (multi-bulk command protocol handling): PERMANENT, VENDOR-ACKNOWLEDGED DENIAL OF SERVICE WITH NO FIX PLANNED. AnNCVD-2025-021-redis-multi-bulk-command-protoco · Redis (multi-bulk command protocol handling)High
• AMD AGESA bootloader - DDR5 PMIC default configuration: The AGESA bootloader leaves DDR5 memory modules in an insecureCVE-2025-48516 · AMD AGESA bootloader - DDR5 PMIC default configurationMedium
• AMD Graphics Driver - out-of-bounds write: Improper input validation lets a local attacker write out of bounds throughCVE-2025-48518 · AMD Graphics Driver - out-of-bounds writeMedium
• Terragrunt: malicious module manifest deletes files outside the module cache during cleanupCVE-2026-45099 · Terragrunt (module cache cleanup, .terragrunt-module-manifest path handling)Medium
• Inspektor Gadget: crafted ld.so.cache in a container stalls the container-start hook cluster-wideCVE-2026-53941 · Inspektor Gadget (uprobe ld.so.cache parser, pkg/uprobetracer)Medium
• Renovate: minimumReleaseAge is not applied to digest updates, so fresh dependency digests reach CI earlyCVE-2026-88884 · Renovate (minimumReleaseAge enforcement for digest updates)Medium