Read the docs
TI-2025-37263 Aliases CVE-2025-59824GHSA-hqrf-67pm-wgfq

Omni Wireguard SideroLink potential escape

Priority LOW 4CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to version 0.48.0, Omni Wireguard SideroLink has the potential to escape. Omni and each Talos machine establish a peer-to-peer (P2P) SideroLink connection using WireGuard to mutually authenticate and authorize access. The WireGuard interface on Omni is configured to ensure that the source IP address of an incoming packet matches the IPv6 address assigned to the Talos peer. However, it performs no validation on the packet's destination address. The Talos end of the SideroLink connection cannot be considered a trusted environment. Workloads running on Kubernetes, especially those configured with host networking, could gain direct access to this link. Therefore, a malicious workload could theoretically send arbitrary packets over the SideroLink interface. This issue has been patched in version 0.48.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00205 10th percentileScored 2026-11-07
Fix Fixed omni (siderolabs): 0.48.0github.com/siderolabs/omni (Go): 0.48.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
siderolabsomnibefore 0.48.00.48.0Patch availableCNA
—github.com/siderolabs/omni (Go)before 0.48.00.48.0Patch availableGHSA-hqrf-67pm-wgfq
  • omni Vendorsiderolabs Affected before 0.48.0 Fixed in 0.48.0 Patch available CNA
  • github.com/siderolabs/omni (Go) Vendor— Affected before 0.48.0 Fixed in 0.48.0 Patch available GHSA-hqrf-67pm-wgfq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:siderolabs:omni:*:*:*:*:*:kubernetes:*:*before 0.48.0Vulnerablesiderolabs
  • cpe:2.3:a:siderolabs:omni:*:*:*:*:*:kubernetes:*:* Versions before 0.48.0 Vulnerable ·siderolabs

Remediation

  • Fix · CNA omni (siderolabs) Fixed in 0.48.0
  • Fix · GHSA-hqrf-67pm-wgfq github.com/siderolabs/omni (Go) Fixed in 0.48.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59824
  2. 2026-10-03 Alias added: GHSA-hqrf-67pm-wgfq

References

Patch 2

Advisory 1

Other 2

  • TI-2025-37275 Omni is Vulnerable to DoS via Empty Create/Update Resource Requests CVSS 3.1HIGH 7.5
  • TI-2025-38119 Omni leaks information via the API CVSS 3.1HIGH 8.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences