{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-21T14:52:44.568","vulnerabilities":[{"cve":{"id":"CVE-2025-59824","sourceIdentifier":"security-advisories@github.com","published":"2025-09-24T20:15:33.343","lastModified":"2025-12-22T14:09:39.370","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to version 0.48.0, Omni Wireguard SideroLink has the potential to escape. Omni and each Talos machine establish a peer-to-peer (P2P) SideroLink connection using WireGuard to mutually authenticate and authorize access. The WireGuard interface on Omni is configured to ensure that the source IP address of an incoming packet matches the IPv6 address assigned to the Talos peer. However, it performs no validation on the packet's destination address. The Talos end of the SideroLink connection cannot be considered a trusted environment. Workloads running on Kubernetes, especially those configured with host networking, could gain direct access to this link. Therefore, a malicious workload could theoretically send arbitrary packets over the SideroLink interface. This issue has been patched in version 0.48.0."},{"lang":"es","value":"Omni gestiona Kubernetes en hardware dedicado (bare metal), máquinas virtuales o en la nube. Antes de la versión 0.48.0, Omni Wireguard SideroLink tiene el potencial de escapar. Omni y cada máquina Talos establecen una conexión SideroLink de punto a punto (P2P) utilizando WireGuard para autenticar y autorizar el acceso mutuamente. La interfaz WireGuard en Omni está configurada para asegurar que la dirección IP de origen de un paquete entrante coincida con la dirección IPv6 asignada al par Talos. Sin embargo, no realiza ninguna validación en la dirección de destino del paquete. El extremo Talos de la conexión SideroLink no puede considerarse un entorno de confianza. Las cargas de trabajo que se ejecutan en Kubernetes, especialmente aquellas configuradas con redes de host (host networking), podrían obtener acceso directo a este enlace. Por lo tanto, una carga de trabajo maliciosa podría, en teoría, enviar paquetes arbitrarios a través de la interfaz SideroLink. Este problema ha sido parcheado en la versión 0.48.0."}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":0.5,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"UNREPORTED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-863"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:siderolabs:omni:*:*:*:*:*:kubernetes:*:*","versionEndExcluding":"0.48.0","matchCriteriaId":"D4CB26E2-9BE2-42BD-8E29-52403A888D68"}]}]}],"references":[{"url":"https://github.com/siderolabs/omni/commit/a5efd816a239e6c9e5ea7c0d43c02c04504d7b60","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/siderolabs/omni/security/advisories/GHSA-hqrf-67pm-wgfq","source":"security-advisories@github.com","tags":["Patch","Vendor Advisory"]}]}}]}