CVE-2026-45776

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Prior to version 11.0.3, a flaw in Open XDMoD's access control logic allows an attacker to submit a crafted HTTPS POST request that sets a session variable used for authorization decisions. If an installation of Open XDMoD includes the optional Job Performance (SUPReMM) module, an attacker could bypass intended data access restrictions and view other users' compute job efficiency metrics. All deployments of Open XDMoD prior to version 11.0.3 that contain the optional Job Performance (SUPReMM) module are impacted. This issue was reported privately on 2026-04-06, and at this time there is no evidence that this vulnerability has been exploited in the wild. The vulnerability was patched in Open XDMoD 11.0.3 on 2026-05-12. As a workaround, apply the patch manually.

• CWE-284

• https://github.com/ubccr/xdmod/releases/tag/v11.0.3-2Release Notes
• https://github.com/ubccr/xdmod/security/advisories/GHSA-3hfh-m242-8rmhPatch, Vendor Advisory
• https://open.xdmod.org/security_patches/GHSA-3hfh-m242-8rmh-0_0_0-11_0_2.patchPatch

Published

Jun 5, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45760(Externally Controlled Reference to a Resource in Another Sp…8.1
• CVE-2026-4577A vulnerability was found in code-projects Exam Form Submiss…2.4
• CVE-2026-45771FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2026-45772Turborepo is a high-performance build system for JavaScript …9.8
• CVE-2026-45773Turborepo is a high-performance build system for JavaScript …6.5
• CVE-2026-45775Discourse is an open-source discussion platform. From versio…6.8
• CVE-2026-45777OpenXDMoD is an open framework for collecting and analyzing …9.8
• CVE-2026-45778OpenXDMoD is an open framework for collecting and analyzing …5.4
• CVE-2026-45779OpenXDMoD is an open framework for collecting and analyzing …9.8
• CVE-2026-4578A vulnerability was determined in code-projects Exam Form Su…2.4
• CVE-2026-45780Discourse is an open-source discussion platform. Prior to 20…4.3
• CVE-2026-45781The MCP Registry provides MCP clients with a list of MCP ser…3.5