CVE-2025-61688
📋 TL;DR
Omni, a Kubernetes management platform, has an API vulnerability that can leak sensitive information. This affects all deployments using Omni versions before 1.1.5 or 1.0.2, potentially exposing credentials, tokens, or configuration data.
💻 Affected Systems
- Omni
📦 What is this software?
Omni by Siderolabs
Omni by Siderolabs
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to administrative credentials, secrets, or sensitive configuration data, leading to complete cluster compromise and data exfiltration.
Likely Case
Unauthorized access to sensitive information like API tokens, service account credentials, or cluster configuration details that could be used for further attacks.
If Mitigated
Limited exposure of non-critical information if proper network segmentation and access controls are implemented.
🎯 Exploit Status
Exploitation requires API access but appears straightforward based on advisory description.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.5 or 1.0.2
Vendor Advisory: https://github.com/siderolabs/omni/security/advisories/GHSA-77r9-w39m-9xh5
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Omni to version 1.1.5 (for main branch) or 1.0.2 (for stable branch). 3. Restart Omni services. 4. Verify the update was successful.
🔧 Temporary Workarounds
Restrict API Access
linuxLimit network access to Omni API endpoints using firewall rules or network policies.
iptables -A INPUT -p tcp --dport [OMNI_API_PORT] -s [TRUSTED_NETWORK] -j ACCEPT
iptables -A INPUT -p tcp --dport [OMNI_API_PORT] -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Omni API endpoints from untrusted networks
- Enable audit logging for all API access and monitor for unusual patterns
🔍 How to Verify
Check if Vulnerable:
Check Omni version: omni version | grep -E '1\.0\.[0-1]|1\.1\.[0-4]'Check Version:
omni versionVerify Fix Applied:
Verify version is 1.1.5 or higher: omni version | grep -E '1\.1\.[5-9]|1\.[2-9]' or for stable branch: omni version | grep -E '1\.0\.[2-9]|1\.[1-9]'📡 Detection & Monitoring
Log Indicators:
- Unusual API access patterns
- Multiple failed authentication attempts followed by successful sensitive data requests
Network Indicators:
- Unexpected external connections to Omni API endpoints
- Traffic patterns indicating data exfiltration
SIEM Query:
source="omni" AND (event_type="api_access" AND sensitive_resource=true) AND src_ip NOT IN [trusted_ips]