Sidero Labs Omni up to 1.6.5/1.7.0-1.7.2 SAML Authentication saml.go SAML.getSession toctou

Summaryinfo

A vulnerability classified as very critical was found in Sidero Labs Omni up to 1.6.5/1.7.0-1.7.2. Impacted is the function SAML.getSession of the file internal/pkg/auth/interceptor/saml.go of the component SAML Authentication. Such manipulation leads to toctou. This vulnerability is traded as CVE-2026-45720. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Sidero Labs Omni up to 1.6.5/1.7.0-1.7.2 and classified as very critical. Affected by this issue is the function SAML.getSession of the file internal/pkg/auth/interceptor/saml.go of the component SAML Authentication. The manipulation with an unknown input leads to a toctou vulnerability. Using CWE to declare the problem leads to CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The attacker can invoke SAML-protected gRPC endpoints, use ConfirmPublicKey to create multiple persistent credentials tied to the victim, and generate audit entries attributed to the victim, with the resulting access potentially affecting confidentiality, integrity, and availability according to the victim's privileges. This issue is fixed in versions 1.6.6 and 1.7.3.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-45720 since 05/13/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 09/17/2026).

Upgrading to version 1.6.6 or 1.7.3 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Sidero Labs

Name

• Omni

Version

• 1.6.0
• 1.6.1
• 1.6.2
• 1.6.3
• 1.6.4
• 1.6.5
• 1.7.0-1.7.0
• 1.7.0-1.7.1
• 1.7.0-1.7.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion