BaseFortify

Publication date: 2025-10-13

Last updated on: 2025-12-04

Assigner: GitHub, Inc.

Description

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.1.5 and 1.0.2, there is a nil pointer dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and denial of service by sending empty create/update resource requests through the API endpoints. The vulnerability exists in the isSensitiveSpec function which calls grpcomni.CreateResource without checking if the resource's metadata field is nil. When a resource is created with an empty Metadata field, the CreateResource function attempts to access resource.Metadata.Version causing a segmentation fault. This vulnerability is fixed in 1.1.5 and 1.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-13

Last Modified

2025-12-04

Generated

2026-07-06

AI Q&A

2025-10-14

EPSS Evaluated

2026-07-05

NVD

CVE-2025-59836

Affected Vendors & Products

Vendor	Product	Version / Range
siderolabs	omni	to 1.0.2 (exc)
siderolabs	omni	From 1.1.0 (inc) to 1.1.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.
CWE-703	The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Attack-Flow Graph

Executive Summary

This vulnerability is a nil pointer dereference in the Omni Resource Service that allows unauthenticated users to cause a server panic and denial of service. It occurs when empty create or update resource requests are sent through the API endpoints. Specifically, the isSensitiveSpec function calls CreateResource without checking if the resource's metadata field is nil. If the Metadata field is empty, CreateResource tries to access resource.Metadata.Version, causing a segmentation fault and crashing the server.

Impact Analysis

The vulnerability can cause a denial of service by crashing the server when it receives empty create or update resource requests. This means an attacker can disrupt the availability of the Omni Resource Service without authentication, potentially impacting the stability and reliability of Kubernetes management on bare metal, virtual machines, or cloud environments.

Mitigation Strategies

Upgrade the Omni Resource Service to version 1.1.5 or 1.0.2 or later, as these versions contain the fix for the nil pointer dereference vulnerability that causes server panic and denial of service.

Hi! I’m here to help you understand CVE-2025-59836. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70