CVE-2026-45720
Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token
Description
Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The attacker can invoke SAML-protected gRPC endpoints, use ConfirmPublicKey to create multiple persistent credentials tied to the victim, and generate audit entries attributed to the victim, with the resulting access potentially affecting confidentiality, integrity, and availability according to the victim's privileges. This issue is fixed in versions 1.6.6 and 1.7.3.
INFO
Published Date :
Sept. 17, 2026, 8:16 p.m.
Last Modified :
Sept. 17, 2026, 8:16 p.m.
Remotely Exploit :
No
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update Omni to version 1.6.6 or later.
- Update Omni to version 1.7.3 or later.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-45720.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-45720 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-45720
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-45720 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-45720 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by [email protected]
Sep. 17, 2026
Action Type Old Value New Value Added Description Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The attacker can invoke SAML-protected gRPC endpoints, use ConfirmPublicKey to create multiple persistent credentials tied to the victim, and generate audit entries attributed to the victim, with the resulting access potentially affecting confidentiality, integrity, and availability according to the victim's privileges. This issue is fixed in versions 1.6.6 and 1.7.3. Added CVSS V3.1 AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Added CWE CWE-294 Added CWE CWE-367 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/45xxx/CVE-2026-45720.json">CVE-2026-45720</a> Added Reference https://github.com/siderolabs/omni/commit/272d3f4dd00e778b39fde09afde35575fe13ef13 Added Reference https://github.com/siderolabs/omni/commit/4c4c1e2d8226914f26774a309a91595f168ee921 Added Reference https://github.com/siderolabs/omni/commit/ced79da6c032d2103803eb53343d0916cc957d2a Added Reference https://github.com/siderolabs/omni/pull/2816 Added Reference https://github.com/siderolabs/omni/releases/tag/v1.6.6 Added Reference https://github.com/siderolabs/omni/releases/tag/v1.7.3 Added Reference https://github.com/siderolabs/omni/security/advisories/GHSA-5x9f-6vg5-qg4m