CVE-2025-58435 Overview
CVE-2025-58435 affects Open OnDemand, an open-source High Performance Computing (HPC) portal. Versions prior to 3.1.15 and 4.0.7 fail to rotate the noVNC session password when used with TurboVNC versions higher than 3.1.2. The flaw falls under CWE-262: Not Using Password Aging.
An attacker who obtains a shared desktop session link can perform any action as the original user and access that user's data. Exploitation requires the legitimate user to share the active session link and the recipient to be authenticated to the portal.
Critical Impact
Session passwords for noVNC interactive applications are not rotated when running TurboVNC above 3.1.2, allowing authenticated portal users with a shared session link to impersonate the original user.
Affected Products
- Open OnDemand versions prior to 3.1.15
- Open OnDemand versions prior to 4.0.7
- Deployments using TurboVNC higher than version 3.1.2
Discovery Timeline
- 2025-09-09 - CVE-2025-58435 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-58435
Vulnerability Analysis
Open OnDemand provides a web portal for launching interactive HPC applications, including noVNC-based remote desktop sessions backed by TurboVNC. The portal is designed to rotate the VNC session password periodically so that a session link captured at one point in time cannot be reused later.
Starting with TurboVNC 3.1.2, the password-rotation path used by Open OnDemand stopped functioning correctly. The server retained the initial session password instead of refreshing it. Any party holding the original URL with embedded credentials can replay it against an active session.
Because the shared link grants full control of the desktop session, an attacker can read files, submit jobs, and run commands on the HPC cluster as the victim. The vulnerability is classified under CWE-262, covering failures to age or rotate passwords.
Root Cause
The password rotation routine in Open OnDemand's noVNC integration did not account for interface changes introduced in TurboVNC 3.1.2 and later. The rotation call silently failed to update the active session credential, leaving the initial password valid for the lifetime of the session.
Attack Vector
Exploitation requires two conditions. First, the legitimate user must share the active session URL, which embeds the current VNC password. Second, the recipient must already be authenticated to the Open OnDemand portal. Once both conditions are met, the recipient can connect to the running desktop and act as the original user. Refer to the GitHub Security Advisory GHSA-7vh8-mw9f-5r99 for additional context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2025-58435
Indicators of Compromise
- Multiple distinct portal user identities connecting to the same noVNC session within a short window.
- noVNC session passwords that remain unchanged across the session lifetime when TurboVNC version is above 3.1.2.
- Unexpected HPC job submissions or file access originating from an active interactive desktop session.
Detection Strategies
- Inventory Open OnDemand deployments and record both the portal version and the installed TurboVNC version to identify vulnerable combinations.
- Review web server access logs for repeated session URL access from different authenticated users or client IP addresses.
- Correlate noVNC WebSocket connections with the portal authentication identity to detect session access by users other than the session owner.
Monitoring Recommendations
- Alert on concurrent noVNC WebSocket connections to the same session from distinct source addresses or user agents.
- Monitor Open OnDemand audit logs for interactive application launches followed by access attempts from non-owner accounts.
- Track TurboVNC package versions across HPC login and compute nodes to catch upgrades that reintroduce the vulnerable combination.
How to Mitigate CVE-2025-58435
Immediate Actions Required
- Upgrade Open OnDemand to version 3.1.15 or 4.0.7, which restore correct password rotation for all supported TurboVNC releases.
- Instruct users not to share interactive desktop session URLs, even with other authenticated portal users.
- Terminate any long-running noVNC sessions that were started before the patch was applied on affected deployments.
Patch Information
Open OnDemand 3.1.15 and 4.0.7 correctly rotate the noVNC password regardless of the installed TurboVNC version. Administrators should apply the upgrade and restart the Open OnDemand services. The fix is documented in the GitHub Security Advisory GHSA-7vh8-mw9f-5r99.
Workarounds
- Downgrade TurboVNC to a version lower than 3.1.2 on all nodes serving noVNC interactive applications until the Open OnDemand upgrade is deployed.
- Enforce portal policies that remind users session links are credential-bearing and must not be reshared.
- Reduce the maximum lifetime of noVNC interactive sessions to limit the window of exposure for any leaked session link.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
