CVE-2025-61688

HIGH8.6EPSS 0.05%

Omni vulnerable to information leak via API

Published: 10/13/2025Modified: 11/5/2025

Also known as:GHSA-77r9-w39m-9xh5GO-2025-4022

Description

### Impact Omni might leak sensitive information via an API. ### Patches v1.1.5, v1.0.2 and v1.2.0 contain the patch. ### Workarounds None. ### References None.

Affected packages (2)

Go/github.com/siderolabs/omni>= 1.1.0-beta.0, < 1.1.5
Go/github.com/siderolabs/omnifrom 0, < 1.0.2, >= 1.1.0-beta.0, < 1.1.5

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-61688
PATCHhttps://github.com/siderolabs/omni
WEBhttps://github.com/siderolabs/omni/security/advisories/GHSA-77r9-w39m-9xh5
WEBhttps://pkg.go.dev/vuln/GO-2025-4022