CVE-2026-45779 is an unauthenticated SQL injection in Open XDMoD versions before 10.0.3, scored 9.8 (critical). The fix has been available since August 2023, but the CVE was published in June 2026. Upgrade to 10.0.3 or later.
What's affected
All Open XDMoD deployments before 10.0.3. The record says the issue was found on 3 August 2023 and patched on 4 August 2023 in version 10.0.3. The CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication or user action is needed.
If you upgraded since late 2023, you are probably covered. Old installs left untouched are the concern. The record says there is no evidence of exploitation in the wild, and the KEV flag is false.
How to check if you're exposed
rpm -q xdmod
For source installs, read the version from the install directory or the web interface. Anything below 10.0.3 is affected. Also check for old copies of XDMoD on test hosts and forgotten VMs, which tend to miss upgrades.
What to do now
- Find every XDMoD instance and its version.
- Upgrade to 10.0.3 or later, preferably a current release, following the upgrade guide at open.xdmod.org/upgrade.
- If you cannot upgrade yet, apply the vendor patch that matches your version. The advisory lists one for versions before 9.0.0 and one for 9.0.0 through 10.0.2. Use
patch -p1 -d [PATH_TO_XDMOD_SHARE_DIR] < [PATH_TO_PATCH_FILE], with the share directory usually/usr/share/xdmodfor RPM installs or/opt/xdmod/sharefor source installs. - Treat the patch as temporary and plan the upgrade.
- Restrict who can reach the web interface and review database and web logs for unexpected activity.
Why it matters
The weakness is CWE-89, SQL injection. Input reaches a database query without being kept separate from the query itself. The record says an unauthenticated remote attacker could run arbitrary SQL and compromise the underlying database.
The long gap between fix and CVE is a lesson in itself. A patch that predates its advisory by almost three years leaves old installs looking safe on every vulnerability feed. Version inventories, not alerts alone, catch them.
Quick check
I run 11.0.2. Am I affected by this one?
No. This CVE covers versions before 10.0.3. Version 11.0.2 is affected by the separate CVE-2026-45777, so move to 11.0.3 or later.
Sources
Last reviewed: 19 October 2026.
