PT-2025-41805 · Omni · Omni

1C3T0Rm + 1 · Published 2025-10-13 · Updated 2025-12-04 · CVE-2025-59836

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Omni versions prior to 1.1.5 Omni version 1.0.2

Description Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. A nil pointer dereference in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sending empty create/update resource requests through the API endpoints. The issue exists in the isSensitiveSpec function which calls grpcomni.CreateResource without checking if the resource's metadata field is nil. When a resource is created with an empty Metadata field, the CreateResource function attempts to access resource.Metadata.Version causing a segmentation fault.

Recommendations Update Omni to version 1.1.5 or later. Update Omni to version 1.0.2.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

CWE-703

Related Identifiers

CVE-2025-59836

GHSA-4P3P-CR38-V5XP

GO-2025-4021

OPENSUSE-SU-2025:15710-1

Affected Products

Omni

References · 86

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59836.json · Exploit
• https://github.com/siderolabs/omni/commit/1fd954af64985a8b3dbf5b11deddbf7cd953f5ae · Patch
• https://github.com/siderolabs/omni/security/advisories/GHSA-4p3p-cr38-v5xp · Vendor Advisory
• https://github.com/siderolabs/omni/commit/1396083f766a1b0380e9949968d7fc17b7afecaa · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59836 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59836 · Security Note
• https://osv.dev/vulnerability/GO-2025-4021 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4p3p-cr38-v5xp · Vendor Advisory
• https://github.com/siderolabs/omni · Note
• https://suse.com/security/cve/CVE-2016-11067 · Note
• https://suse.com/security/cve/CVE-2025-58073 · Note
• https://suse.com/security/cve/CVE-2016-11078 · Note
• https://suse.com/security/cve/CVE-2025-59043 · Note
• https://suse.com/security/cve/CVE-2025-11375 · Note