CVE-2025-61688: Siderolabs Omni Information Disclosure

CVE-2025-61688 Overview

CVE-2025-61688 is an information disclosure vulnerability in Siderolabs Omni, a platform for managing Kubernetes clusters across bare metal, virtual machines, and cloud environments. Versions prior to 1.0.2 and 1.1.5 may leak sensitive information through an exposed API. Unauthenticated network attackers can query the affected API surface to retrieve data that should remain protected. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Siderolabs has published a fix in the GHSA-77r9-w39m-9xh5 advisory.

Critical Impact

Remote unauthenticated attackers can retrieve sensitive Omni data over the network without user interaction, exposing Kubernetes management infrastructure to reconnaissance and follow-on attacks.

Affected Products

• Siderolabs Omni versions prior to 1.0.2 (1.0.x branch)
• Siderolabs Omni versions prior to 1.1.5 (1.1.x branch)
• Self-hosted Omni Kubernetes management deployments

Discovery Timeline

• 2025-10-13 - CVE-2025-61688 published to NVD
• 2025-12-04 - Last updated in NVD database

Technical Details for CVE-2025-61688

Vulnerability Analysis

The vulnerability exists in the API layer of Siderolabs Omni, the control plane used to provision and manage Kubernetes clusters. According to the vendor advisory, an API endpoint returns sensitive information without enforcing the access controls expected for the data it handles. Because Omni operates as a centralized management plane for Kubernetes infrastructure, leaked data can include configuration or operational details valuable to an attacker mapping the environment.

Network-based attackers can reach the affected API without authentication and without user interaction. The flaw affects confidentiality only; integrity and availability of Omni and its managed clusters are not directly impacted by this issue.

Root Cause

The root cause maps to [CWE-200], where the application discloses information to an actor not explicitly authorized to access it. The Omni API path in question fails to apply sufficient authorization checks before returning response data, enabling unauthorized callers to read content that should be restricted to authenticated principals.

Attack Vector

Exploitation requires only network access to the Omni API endpoint. An attacker sends crafted HTTP requests to the vulnerable API and parses responses for sensitive fields. Internet-exposed Omni instances are at highest risk, but any attacker with reachability to the management API in a corporate or cloud network can attempt the same technique. No credentials, privileges, or victim interaction are required. Refer to the Siderolabs security advisory GHSA-77r9-w39m-9xh5 for technical specifics.

Detection Methods for CVE-2025-61688

Indicators of Compromise

• Unexpected anonymous or unauthenticated requests to Omni API endpoints in HTTP access logs.
• Bursts of API enumeration traffic from a single source IP scanning Omni paths.
• Outbound transfers of unusually large API response payloads from the Omni server.

Detection Strategies

• Audit Omni API access logs for requests that succeed without an associated authenticated session identifier.
• Compare running Omni server versions against patched releases 1.0.2 and 1.1.5 across all environments.
• Apply web application firewall rules to flag access to Omni API routes from sources outside known administrator networks.

Monitoring Recommendations

• Forward Omni API and reverse proxy logs into a centralized SIEM for behavioral baselining.
• Alert on anomalous request rates or response sizes from the Omni control plane.
• Continuously monitor exposure of Omni management interfaces to the public internet using attack surface management tooling.

How to Mitigate CVE-2025-61688

Immediate Actions Required

• Upgrade Omni immediately to version 1.0.2 or 1.1.5 or later, depending on your release branch.
• Restrict network access to the Omni API to trusted administrative networks using firewalls or zero-trust gateways.
• Review Omni audit logs for prior unauthorized API access and rotate any secrets that may have been exposed.

Patch Information

Siderolabs has released fixed versions 1.0.2 and 1.1.5 that remediate the information disclosure. Patch details and remediation guidance are available in the GHSA-77r9-w39m-9xh5 advisory. Operators running self-hosted Omni should plan an upgrade window and validate the deployment after patching.

Workarounds

• Place the Omni API behind an authenticating reverse proxy or VPN until upgrades are completed.
• Apply network policies to limit Omni API reachability to a small set of administrator source IPs.
• Disable or block any externally exposed Omni endpoints that are not strictly required for operations.

# Configuration example: restrict Omni API exposure with iptables until patched
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP