CVE-2025-61688CWE-200information-disclosure

CVE-2025-61688

High · published October 14, 2025

CVSS v3.1

8.6

EPSS

Percentile

22.8

In the wild

Unconfirmed

What it is

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, Omni might leak sensitive information via an API.

The record

Technical detail

CVSS v3.1: 8.6 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00312 · 22.8th percentile
Weakness: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published: 2025-10-14T01:15Z

Affected products (2)

Product	Versions	Fixed in
siderolabs/omni	< 1.0.2	1.0.2
siderolabs/omni	≥ 1.1.0, < 1.1.5	1.1.5

References (1)

EPSS history

Timeline