CVE-2026-45779
Open XDMoD is an open framework for collecting and analyzing HPC metrics. Versions before 10.0.3 contain an SQL injection flaw that lets attackers run arbitrary SQL without authentication. This can lead to full compromise of the underlying database.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Open XDMoD versions prior to 10.0.3, used by high‑performance computing environments.
Real-world impact
An attacker can execute any SQL commands on the database, potentially stealing, modifying, or deleting data, and may gain full control of the database server.
Why this severity
The CVSS score of 9.3 reflects that the flaw is easy to exploit (low attack complexity), requires no user interaction, and gives the attacker complete control over the database, making it a critical vulnerability.
What to do about it
- 01Upgrade Open XDMoD to version 10.0.3 or later.
NVD-referenced vendor advisory
Timeline
- Jun 5, 2026 · Jun 5, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- github.com/ubccr/xdmod/releases/tag/v1…release notes
- github.com/ubccr/xdmod/security/adviso…mitigationpatchvendor advisory
- open.xdmod.org/security_patches/GHSA-r33r-…patch
- open.xdmod.org/security_patches/GHSA-r33r-…patch