CVE-2025-61688

Published: Oct 13, 2025

Modified: Oct 14, 2025

PUBLISHED

CVSS v3.1

8.6

HIGH

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, Omni might leak sensitive information via an API.

Vendor	Product	Versions
siderolabs	omni	affected `>= 1.1.0-beta.0, < 1.1.5` affected `< 1.0.2`

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.