CVE-2026-26002 is a critical injection flaw (CVSS 9.8) in the Files application of Open OnDemand, the HPC portal. Malicious input is mishandled when a user navigates to a directory. Upgrade to 4.0.9 or 4.1.3, the patched releases. The record does not list it in CISA's KEV catalog, and the advisory we read does not report exploitation.
What's affected
- Open OnDemand 4.0.x before 4.0.9
- Open OnDemand 4.1.x before 4.1.3
- The advisory also lists 3.x below 3.1.16 as affected but names no patched 3.x release
The advisory lists no workaround and says versions below the fixed ones remain susceptible. It also gives limited technical detail.
How to check if you're exposed
Find the version your site runs. The portal is usually installed from a package or built by your HPC team, so ask whoever deploys it, or use your package manager's query for the OnDemand package. Check each cluster separately, since sites often run more than one portal.
If you are on 3.x, plan a move to a supported line, because the advisory does not name a patched 3.x release.
What to do now
- Upgrade to 4.0.9 or 4.1.3, depending on your line.
- If you run 3.x, schedule an upgrade to a fixed line and ask the project about interim guidance.
- Review who can reach the portal and put it behind your institution's single sign on and network controls.
- Check portal logs for unusual directory requests around the Files app.
- Record the fixed versions in your change ticket and confirm after deployment.
Why it matters
The weakness class is CWE-74, injection: input is treated as part of something the application interprets. The advisory says the patch addressed several things in the Files app, among them users navigating to a file when they meant to enter a directory, links for some protocols that were not disabled, and HTML in breadcrumbs and shell buttons that was not cleaned. That points to unsafe output of user controlled values, but the advisory assigns no more precise class.
HPC portals are worth care. They sit in front of shared clusters, file systems and many user accounts, so a flaw in a web front end can matter more than its code size suggests. Keeping the portal current and behind your normal access controls is the sensible baseline.
Quick check
Which release do I pick?
Pick 4.0.9 if you are on the 4.0 line and 4.1.3 if you are on the 4.1 line.
Is 3.x patched?
The advisory names no patched 3.x release. Ask the project, and plan an upgrade.
Sources
Last reviewed: 19 October 2026.
