CVE-2026-45777

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45777
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45777.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45777
Aliases
  • GHSA-29qm-7w4v-43fw
Published
2026-06-05T19:27:50Z
Modified
2026-08-12T03:51:33Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Open XDMoD Vulnerable to Unauthenticated Remote Code Execution (RCE) via OS Command Injection
Details

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Starting in version 9.5.0 and prior to version 11.0.3, an attacker can remotely execute arbitrary system commands on the web server hosting Open XDMoD with the privileges of the web server process. This could allow an attacker to read or modify application data, alter system configuration, or disrupt service availability. All deployments of Open XDMoD versions 9.5.0 through 11.0.2 (inclusive) are impacted. This issue was reported privately on 2026-04-06, and at this time there is no evidence that this vulnerability has been exploited in the wild. The vulnerability was patched in Open XDMoD 11.0.3 on 2026-05-12. As a workaround, apply the patch manually.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45777.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "9.5.0"
                },
                {
                    "fixed": "11.0.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "introduced": "9.5.0"
                },
                {
                    "fixed": "11.0.2"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git / github.com/ubccr/xdmod

Affected ranges

Type
GIT
Repo
https://github.com/ubccr/xdmod
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0b32a9e5d05963227ba0c9f38387bff162fd5851
Database specific
Show details 
{
    "source": "REFERENCES"
}

Affected versions

v10.*
v10.0.0
v10.0.0-beta3-el8
v10.0.0-rc.1
v10.0.0-rc.2
v10.0.0-rc.3
v10.0.5-rc.1
v10.5.0
v10.5.0-1.0
v10.5.0-rc.1
v10.5.0-rc.2
v10.5.0-rc.3
v11.*
v11.0.0-1.0
v11.0.0-access-p1
v11.0.0-rc.1
v11.0.0-rc.2
v11.0.1-1
v11.0.1-rc.1
v11.0.1-rc.2
v11.0.1-rc.3
v11.0.2-1
v11.0.2-2
v11.0.2-3
v11.0.2-access-p1
v11.0.2-access-p2
v11.0.2-access-p3-1
v11.0.2-access-p4-1
v11.0.2-rc.1
v11.0.3-1
v11.0.3-rc.1-1
v6.*
v6.6.0-beta.1
v6.6.0-beta.2
v7.*
v7.1.0-alpha.1
v7.5.0
v7.5.0-rc.1
v7.5.0-rc.2
v8.*
v8.0.0
v8.1.0
v8.1.0-rc.1
v8.5.0-rc.1
v8.5.0-rc.2
v8.6.0-rc.3
v9.*
v9.0.0
v9.0.0-rc.1
v9.0.0-rc.2
v9.0.0-rc.3
v9.0.0-rc.4
v9.5.0
v9.5.0-rc.1
v9.5.0-rc.2
v9.5.0-rc.3
v9.5.0-rc.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45777.json"