OpenXDMoD is an open framework for collecting and analyzing HPC metrics

Public CVE metadata describes CVE-2026-45779 as an unauthenticated remote SQL injection in Open XDMoD affecting versions prior to 10.0.3, disclosed on 2026-06-05 and fixed in the 10.0.3 release that shipped on 2023-08-04. The only visible upstream change tied to that release is a fix for handling filter strings containing quote characters, which strongly suggests the bug sits in request or filter parsing associated with portal queries; that endpoint mapping is an inference, not something the upstream release notes spell out explicitly.

With no vendor CVSS baseline, my first-principles read is = ASSESSED AT HIGH. The amplifier is obvious: if an attacker can reach the vulnerable web portal, pre-auth SQLi can usually mean database read/write and session or admin-impact potential. The downward pressure is equally real: Open XDMoD is a specialized HPC metrics platform, many deployments are institution-internal or VPN-gated, and the affected branch is already unsupported legacy 10.0 rather than the current 11.x line. Bad bug, smaller reachable population.

Why this verdict

• Pre-auth remote path: no credentials or user interaction are required in the public CVE metadata, which is the main upward pressure.
• Database compromise matters: even without proven host RCE, application-database read/write can expose users, sessions, reports, and operational data.
• Legacy branch only: the public fix trail points to 10.0.3 from 2023-08-04, and current docs list 10.0 as unsupported, so the affected population is narrower than a live mainstream branch.
• Niche product friction: Open XDMoD is an HPC-specific portal, not a broadly deployed enterprise platform; fewer targets means fewer opportunistic attackers and less spray-and-pray risk.
• Reachability is the real filter: many deployments are institution-internal, VPN-gated, or otherwise not broadly exposed, which compounds the downward adjustment from the raw bug class.

Why not higher?

I am not calling this CRITICAL because the public material does not establish mass internet exposure, active exploitation, or guaranteed host-level code execution from this CVE alone. The affected branch is also old and unsupported, which narrows the vulnerable population relative to a fresh bug in the current supported train.

Why not lower?

I am not dropping this to MEDIUM because unauthenticated remote SQL injection remains a first-stage compromise primitive when the portal is reachable. The lack of a public PoC or KEV entry does not erase the fact that the attacker position is still internet-to-app with potentially high data impact.

1. Restrict portal reachability — Put Open XDMoD behind VPN, SSO gateway policy, IP allowlists, or a reverse proxy that limits who can hit the portal. For a HIGH verdict, deploy this within 30 days if the service is not already fenced.
2. Add WAF or proxy rules for filter payloads — Block obvious quote-heavy, boolean, UNION, and time-delay payloads on the request paths used by portal filtering and query functions. This is not a perfect fix, but it is a useful speed bump to deploy within 30 days while remediation is scheduled.
3. Reduce DB account privileges — Validate that the Open XDMoD application account cannot create functions, write arbitrary files, or administer the server. Least privilege contains blast radius if injection lands; complete this review within 30 days.
4. Turn on query and access logging — Enable or retain Apache access logs, reverse-proxy logs, SQL audit or slow-query logging, and alerting for repeated quote/time-delay patterns. Do this within 30 days so you have evidence if someone is already probing.
5. Inventory and retire 10.0 deployments — Current docs show 10.0 is unsupported, so any surviving instances deserve explicit owner assignment and migration planning. Treat discovery and ownership mapping as a 30-day control action even if full patching takes longer.

Run this on the Open XDMoD host itself as root or a user who can query package metadata and read /etc/httpd/conf.d/xdmod.conf. Example: sudo bash check_xdmod_cve_2026_45779.sh. It checks RPM/DPKG metadata first, then falls back to the Apache config or /opt/xdmod-* install paths, and prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# check_xdmod_cve_2026_45779.sh
# Detect likely exposure to CVE-2026-45779 in Open XDMoD.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN / unable to determine

set -u

TARGET_FIXED="10.0.3"

extract_semver() {
  # Extract first X.Y.Z-like token from a string
  echo "$1" | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1
}

ver_lt() {
  # returns 0 if $1 < $2
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ] && [ "$1" != "$2" ]
}

ver_ge() {
  # returns 0 if $1 >= $2
  ! ver_lt "$1" "$2"
}

VERSION=""
SOURCE=""

# 1) RPM
if command -v rpm >/dev/null 2>&1; then
  if rpm -q xdmod >/dev/null 2>&1; then
    RAW="$(rpm -q --qf '%{VERSION}\n' xdmod 2>/dev/null | head -n1)"
    VERSION="$(extract_semver "$RAW")"
    SOURCE="rpm:xdmod"
  fi
fi

# 2) DPKG fallback (unlikely, but harmless)
if [ -z "$VERSION" ] && command -v dpkg-query >/dev/null 2>&1; then
  RAW="$(dpkg-query -W -f='${Version}\n' xdmod 2>/dev/null | head -n1)"
  VERSION="$(extract_semver "$RAW")"
  if [ -n "$VERSION" ]; then
    SOURCE="dpkg:xdmod"
  fi
fi

# 3) Apache config path fallback
if [ -z "$VERSION" ] && [ -r /etc/httpd/conf.d/xdmod.conf ]; then
  RAW="$(grep -Eo '/opt/xdmod-[0-9]+\.[0-9]+\.[0-9]+' /etc/httpd/conf.d/xdmod.conf 2>/dev/null | head -n1)"
  VERSION="$(extract_semver "$RAW")"
  if [ -n "$VERSION" ]; then
    SOURCE="apache-conf"
  fi
fi

# 4) /opt directory fallback
if [ -z "$VERSION" ]; then
  RAW="$(find /opt -maxdepth 1 -type d -name 'xdmod-*' 2>/dev/null | sort -V | tail -n1)"
  VERSION="$(extract_semver "$RAW")"
  if [ -n "$VERSION" ]; then
    SOURCE="/opt-scan"
  fi
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - could not determine installed Open XDMoD version"
  exit 2
fi

# Public metadata says affected versions are prior to 10.0.3.
if ver_lt "$VERSION" "$TARGET_FIXED"; then
  echo "VULNERABLE - Open XDMoD version $VERSION detected via $SOURCE (< $TARGET_FIXED)"
  exit 1
fi

if ver_ge "$VERSION" "$TARGET_FIXED"; then
  echo "PATCHED - Open XDMoD version $VERSION detected via $SOURCE (>= $TARGET_FIXED)"
  exit 0
fi

echo "UNKNOWN - version $VERSION detected via $SOURCE but comparison failed"
exit 2

Sources

1. Open XDMoD 10.0.3 release
2. Open XDMoD 10.0.3 release commit
3. Upstream PR #1749 for quote-handling fix
4. Open XDMoD hardware requirements
5. Open XDMoD upgrade guide
6. Open XDMoD GitHub repository
7. Open XDMoD First Principles Vulnerability Assessment
8. CISA Known Exploited Vulnerabilities Catalog