Nixpkgs security tracker

Try the new UI
Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2026-45720
7.0 HIGH
  • CVSS version (CVSS): 3.1
  • Attack Vector (AV): Local (L)
  • Attack Complexity (AC): High (H)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): Required (R)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H)
  • Integrity (I): High (H)
  • Availability (A): High (H)
  • Modified Attack Vector (MAV): Local (L)
  • Modified Attack Complexity (MAC): High (H)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): Required (R)
  • Modified Confidentiality (MC): High (H)
  • Modified Scope (MS): Unchanged (U)
  • Modified Integrity (MI): High (H)
  • Modified Availability (MA): High (H)
created 3 days, 20 hours ago Activity log
  • Created suggestion 3 days, 20 hours ago
Omni: TOCTOU race condition allows multiple concurrent uses of a single-use SAML session token

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The attacker can invoke SAML-protected gRPC endpoints, use ConfirmPublicKey to create multiple persistent credentials tied to the victim, and generate audit entries attributed to the victim, with the resulting access potentially affecting confidentiality, integrity, and availability according to the victim's privileges. This issue is fixed in versions 1.6.6 and 1.7.3.

Affected products

omni
  • ==>= 1.7.0, < 1.7.3
  • ==< 1.6.6

Matching in nixpkgs

pkgs.omnix

Nix companion to improve developer experience

  • nixos-unstable -
    • nixos-unstable-small 1.3.2
  • nixos-26.05 -
    • nixos-26.05-small 1.3.2

pkgs.omniwm

MacOS Niri and Hyprland inspired tiling window manager

  • nixos-unstable -
    • nixos-unstable-small 0.6.8

pkgs.omnictl

CLI for the Sidero Omni Kubernetes management platform

  • nixos-unstable -
  • nixos-26.05 -
    • nixos-26.05-small 1.7.3

pkgs.omniorb

Robust high performance CORBA ORB for C++ and Python

  • nixos-unstable -
    • nixos-unstable-small 4.3.4
  • nixos-26.05 -
    • nixos-26.05-small 4.3.3

pkgs.sbomnix

Utilities to help with software supply chain challenges on nix targets

  • nixos-unstable -
    • nixos-unstable-small 1.8.0
  • nixos-26.05 -
    • nixos-26.05-small 1.7.6

pkgs.insomnia

Open-source, cross-platform API client for GraphQL, REST, WebSockets, SSE and gRPC, with Cloud, Local and Git storage

  • nixos-unstable -
  • nixos-26.05 -

pkgs.omnissa-horizon-client

Allows you to connect to your Omnissa Horizon virtual desktop

  • nixos-unstable -
    • nixos-unstable-small 2606
  • nixos-26.05 -
    • nixos-26.05-small 2606

pkgs.gnomeExtensions.omnipanel

OmniPanel is a Multi-Monitor advanced window management solution for productivity, featuring configurable zones for windows, smart auto-placement, and automatic tiling.

  • nixos-unstable -
    • nixos-unstable-small 23

pkgs.haskellPackages.omnicodec

Data encoding and decoding command line utilities

  • nixos-unstable -
    • nixos-unstable-small 0.8
  • nixos-26.05 -
    • nixos-26.05-small 0.8