CVE-2026-45776
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Open XDMoD before version 11.0.3 has a flaw in access control logic that allows an attacker to send a crafted HTTPS POST request setting a session variable used for authorization. If the optional Job Performance (SUPReMM) module is installed, the attacker can bypass data access restrictions and view other users' compute job efficiency metrics.
Risk Assessment
Unauthorized access to sensitive HPC job performance data can compromise user privacy and confidentiality.
Recommendation
Update Open XDMoD to version 11.0.3 or apply the manual patch if an update is not possible.
Other vulnerabilities in Open XDMoD
See all- CVE-2026-45777Critical
Open XDMoD versions 9.5.0 through 11.0.2 contain a vulnerability allowing remote arbitrary system command execution on the web server. An attacker can execute commands with the privileges of the web server process.
- CVE-2018-16988Critical
An authentication bypass issue was discovered in Open XDMoD through version 7.5.0, which can lead to account takeover. A weak password reset mechanism allows an attacker to perform a brute-force attack on the MD5 rid value, requiring only 600 guesses if they know the victim initiated a password reset process in the past few minutes.
Original NVD description (English source)
OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Prior to version 11.0.3, a flaw in Open XDMoD's access control logic allows an attacker to submit a crafted HTTPS POST request that sets a session variable used for authorization decisions. If an installation of Open XDMoD includes the optional Job Performance (SUPReMM) module, an attacker could bypass intended data access restrictions and view other users' compute job efficiency metrics. All deployments of Open XDMoD prior to version 11.0.3 that contain the optional Job Performance (SUPReMM) module are impacted. This issue was reported privately on 2026-04-06, and at this time there is no evidence that this vulnerability has been exploited in the wild. The vulnerability was patched in Open XDMoD 11.0.3 on 2026-05-12. As a workaround, apply the patch manually.