CVE-2026-45777
OpenXDMoD, a framework for collecting high‑performance computing metrics, has a critical flaw that lets attackers run any system command on the web server. The issue affects versions 9.5.0 through 11.0.2 and was fixed in version 11.0.3 released on May 12 2026.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
All installations of OpenXDMoD from version 9.5.0 up to and including 11.0.2, typically used by HPC administrators and researchers.
Real-world impact
An attacker could execute arbitrary commands with the web server’s privileges, allowing them to read or alter application data, change system settings, or bring the service down.
Why this severity
The CVSS score of 9.3 reflects the high impact of the vulnerability: attackers can gain full control of the server (high confidentiality, integrity, and availability impact) with no authentication or user interaction required.
What to do about it
- 01Upgrade OpenXDMoD to version 11.0.3 or later.
- 02Restart the web server hosting OpenXDMoD to apply the update.
NVD-referenced vendor advisory
Timeline
- Jun 5, 2026 · Jun 5, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/ubccr/xdmod/releases/tag/v1…release notes
- github.com/ubccr/xdmod/security/adviso…patchvendor advisory
- open.xdmod.org/security_patches/GHSA-29qm-…patch