Is CVE-2026-45779 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45779 being exploited in the wild.

How severe is CVE-2026-45779?

Informational severity, with a CVSS score of 9.3, published 5 June 2026.

Is there a fix for CVE-2026-45779?

A patch was published on 2023-08-04: Version 10.0.3 released and patches made available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45779 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45779?

Check whether you run UBCCR Open XDMoD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45779: ubccr Open XDMoD SQL injection in Metric Explorer

CVE-2026-45779 · Severity: info · CVSS 9.3 · Published 2026-06-05

Open XDMoD, a tool used to analyze performance metrics for high-performance computing (HPC) clusters, contains a critical security flaw. An attacker can use this vulnerability to gain full control over the application's database without needing a username or password. This could lead to the theft of sensitive performance data, modification of system records, or a complete shutdown of the monitoring service.

Technologies: UBCCR Open XDMoD. Vendors: UBCCR.

Quick answers

Is CVE-2026-45779 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45779 being exploited in the wild.
How severe is CVE-2026-45779?: Informational severity, with a CVSS score of 9.3, published 5 June 2026.
Which products and versions are affected?: UBCCR Open XDMoD < 10.0.3.
Is there a fix for CVE-2026-45779?: A patch was published on 2023-08-04: Version 10.0.3 released and patches made available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45779 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45779?: Check whether you run UBCCR Open XDMoD at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An SQL injection vulnerability exists in Open XDMoD due to improper neutralization of special elements in SQL commands (CWE-89), specifically within the Metric Explorer component's handling of filter characters like quotes. The flaw allows a remote, unauthenticated attacker to send malicious SQL queries over the network without any user interaction. Successful exploitation can lead to a complete compromise of the underlying database, including unauthorized data extraction, modification, or deletion. The issue is resolved in version 10.0.3, and manual patches are available for older deployments.

Affected products

ubccr Open XDMoD < 10.0.3

Timeline

2023-08-03: disclosed: Vulnerability discovered
2023-08-04: patched: Version 10.0.3 released and patches made available
2026-05-12: advisory: GitHub Security Advisory published
2026-06-05: advisory: NVD published CVE-2026-45779

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.