CVE-2026-45777 is an OS command injection in Open XDMoD, the HPC metrics framework, scored 9.8 (critical). Versions 9.5.0 through 11.0.2 let a remote attacker run commands as the web server user. Upgrade to 11.0.3.
What's affected
Open XDMoD 9.5.0 through 11.0.2, inclusive. The fix shipped in 11.0.3 on 12 May 2026. The CVSS vector is AV:N/AC:L/PR:N/UI:N, so no login is needed.
The record says the issue was reported privately on 6 April 2026 and that there is no evidence of exploitation in the wild. The KEV flag is false.
How to check if you're exposed
Find your installed version.
rpm -q xdmod
For source installs, check the version in the web interface or the install directory, usually under /opt/xdmod. If it falls from 9.5.0 to 11.0.2, you are affected. The web server user's privileges matter too: commands run as that user, so look at what it can read and write on the host.
What to do now
- Confirm the version on every XDMoD host, including test systems.
- Upgrade to 11.0.3 using the upgrade guide at open.xdmod.org/upgrade.
- If you cannot upgrade right away, apply the vendor patch with the command the advisory gives:
patch -p1 -d [share dir] < [patch file]. The share directory is/usr/share/xdmodfor RPM installs, or/opt/xdmod/shareor similar for source installs. The patch utility must be installed. - Treat the patch as temporary and schedule the upgrade.
- Limit network access to the web interface to the networks that need it, and review web server logs for odd requests.
Why it matters
The weakness is CWE-78, OS command injection: input from outside is used to build an operating system command without being neutralized. Per the record, an attacker could read or change application data, alter system configuration or disrupt service.
XDMoD usually sits next to HPC clusters, which makes the host worth protecting. Fix it promptly even though there is no known exploitation.
Quick check
Is the manual patch enough?
The advisory offers it as a workaround for when you cannot upgrade, and calls for upgrading later. Treat 11.0.3 as the real fix.
Sources
Last reviewed: 19 October 2026.
