CVE-2026-45777: Open XDMoD Vulnerable to Unauthenticated Remote Code Execution (RCE) via OS Command Injection

Synopsis

OS command injection vulnerability in Open XDMoD (versions 9.5.0 through 11.0.2) allows an unauthenticated remote attacker to execute arbitrary system commands on the web server hosting the application. The vulnerability is reachable over the network with no authentication and no user interaction required, giving the attacker the full privileges of the web server process. Successful exploitation enables reading or modifying application data, altering system configuration, and disrupting service availability. A patched-image rebuild at version 11.0.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Open XDMoD web service over the network; any internet- or intranet-exposed deployment is within scope.

• AuthenticationNot required

  No account or session credentials are needed; the injection point is accessible to anonymous requests.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the exploit is fully server-side.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, special memory layout, or environmental setup beyond network access to the target.

Blast Radius

• The attacker executes arbitrary operating system commands with the privileges of the web server process, enabling full control of the application runtime.
• Application data stored on the server, including HPC metrics, user records, and configuration files, can be read or modified directly.
• System-level configuration files accessible to the web server process can be altered, potentially enabling persistence or lateral movement within the host.
• The web server process can be terminated or its resources exhausted, taking the Open XDMoD service offline.