{"cve":"CVE-2025-59824","nvd":{"published":"2025-09-24T20:15:33.343","modified":"2026-06-17T09:46:46.340","status":"Analyzed","description":"Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to version 0.48.0, Omni Wireguard SideroLink has the potential to escape. Omni and each Talos machine establish a peer-to-peer (P2P) SideroLink connection using WireGuard to mutually authenticate and authorize access. The WireGuard interface on Omni is configured to ensure that the source IP address of an incoming packet matches the IPv6 address assigned to the Talos peer. However, it performs no validation on the packet's destination address. The Talos end of the SideroLink connection cannot be considered a trusted environment. Workloads running on Kubernetes, especially those configured with host networking, could gain direct access to this link. Therefore, a malicious workload could theoretically send arbitrary packets over the SideroLink interface. This issue has been patched in version 0.48.0.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U","score":0.5},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4},"cwes":["CWE-863"],"references":["https://github.com/siderolabs/omni/commit/a5efd816a239e6c9e5ea7c0d43c02c04504d7b60","https://github.com/siderolabs/omni/security/advisories/GHSA-hqrf-67pm-wgfq"],"products":["siderolabs:omni"],"source":"nvd","synced_at":"2026-10-19T22:10:08.713834912+00:00"},"epss":{"cve":"CVE-2025-59824","score":0.00196,"percentile":0.09292,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-hqrf-67pm-wgfq","url":"https://osv.dev/vulnerability/GHSA-hqrf-67pm-wgfq","summary":"Omni Wireguard SideroLink potential escape","modified":"2025-10-23T20:12:50Z","packages":[{"ecosystem":"Go","name":"github.com/siderolabs/omni","purl":"pkg:golang/github.com/siderolabs/omni","ranges":["<0.48.0"],"fixed":["0.48.0"]}]},{"id":"GO-2025-3979","url":"https://osv.dev/vulnerability/GO-2025-3979","summary":"Omni Wireguard SideroLink potential escape in github.com/siderolabs/omni","modified":"2026-03-03T04:56:56.702540Z","packages":[{"ecosystem":"Go","name":"github.com/siderolabs/omni","purl":"pkg:golang/github.com/siderolabs/omni","ranges":["<0.48.0"],"fixed":["0.48.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}