siderolabs has 6 CVEs on record between 2025 and 2026. 4 were published in the last 90 days. The busiest recent month was September 2026 with 3. The median CVSS is 6.2 (medium). None have a confirmed exploitation report. Most affected products: omni (5), talos (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.2
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2025-61688High· 8.6Omni manages Kubernetes on bare metal, virtual machines, or in a cloud47CVE-2026-45726High· 7.6Omni manages Kubernetes on bare metal, virtual machines, or in a cloud42CVE-2026-45720High· 7.0Omni manages Kubernetes on bare metal, virtual machines, or in a cloud39CVE-2025-59836Medium· 5.3Omni manages Kubernetes on bare metal, virtual machines, or in a cloud29CVE-2026-77564Low· 3.3Talos Linux is a Linux distribution built for Kubernetes deployments18
siderolabs vulnerabilities
CVEs affecting siderolabs, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-77564Low· 3.3Talos Linux is a Linux distribution built for Kubernetes deployments
Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.ta…
CVE-2026-45726High· 7.6Omni manages Kubernetes on bare metal, virtual machines, or in a cloud
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle…
CVE-2026-45723Low· 2.7Omni manages Kubernetes on bare metal, virtual machines, or in a cloud
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClie…
CVE-2026-45720High· 7.0Omni manages Kubernetes on bare metal, virtual machines, or in a cloud
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state ope…
CVE-2025-61688High· 8.6Omni manages Kubernetes on bare metal, virtual machines, or in a cloud
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, Omni might leak sensitive information via an API.
CVE-2025-59836Medium· 5.3Omni manages Kubernetes on bare metal, virtual machines, or in a cloud
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, there is a nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and deni…