Executive brief
Open XDMoD, a tool used to analyze performance metrics for high-performance computing (HPC) clusters, contains a critical security flaw. An attacker can use this vulnerability to gain full control over the application's database without needing a username or password. This could lead to the theft of sensitive performance data, modification of system records, or a complete shutdown of the monitoring service.
Technical details
An SQL injection vulnerability exists in Open XDMoD due to improper neutralization of special elements in SQL commands (CWE-89), specifically within the Metric Explorer component's handling of filter characters like quotes. The flaw allows a remote, unauthenticated attacker to send malicious SQL queries over the network without any user interaction. Successful exploitation can lead to a complete compromise of the underlying database, including unauthorized data extraction, modification, or deletion. The issue is resolved in version 10.0.3, and manual patches are available for older deployments.
Affected products
- ubccr Open XDMoD < 10.0.3
Timeline
- 2023-08-03: disclosed: Vulnerability discovered
- 2023-08-04: patched: Version 10.0.3 released and patches made available
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-05: advisory: NVD published CVE-2026-45779