CVE-2026-26002: Open OnDemand Path Traversal Vulnerability

CVE-2026-26002 Overview

Open OnDemand is an open-source high-performance computing (HPC) portal that provides web-based access to HPC resources. A vulnerability exists in the Files application component where malicious input can be injected when navigating to a directory. This injection vulnerability (CWE-74) allows authenticated users to potentially manipulate directory navigation behavior through crafted input.

Critical Impact

Authenticated attackers can exploit the Files application to inject malicious input during directory navigation, potentially compromising the integrity and confidentiality of HPC resources.

Affected Products

• Open OnDemand versions prior to 4.0.9
• Open OnDemand versions prior to 4.1.3
• Open OnDemand Files application component

Discovery Timeline

• 2026-03-04 - CVE-2026-26002 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-26002

Vulnerability Analysis

This vulnerability falls under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly known as an Injection vulnerability. The Files application in Open OnDemand fails to properly validate or sanitize user-supplied input when processing directory navigation requests.

The vulnerability requires network access and low-privilege authentication to exploit. Once authenticated, an attacker can craft malicious input during directory traversal operations within the Files application interface. The impact is significant as it can affect the confidentiality, integrity, and availability of the local scope without propagating to other systems.

Organizations running HPC environments with Open OnDemand are particularly at risk, as these environments typically handle sensitive research data and computational workloads.

Root Cause

The root cause of this vulnerability lies in improper input validation within the Files application's directory navigation functionality. When a user navigates to a directory, the application fails to adequately neutralize special elements or characters in the input, allowing injection attacks. This is a classic case of trusting user input without proper sanitization, enabling attackers to inject malicious payloads that are processed by downstream components.

Attack Vector

The attack vector is network-based, requiring the attacker to have authenticated access to the Open OnDemand portal. The attack flow involves:

1. An authenticated user accesses the Files application within Open OnDemand
2. When navigating to a directory, the attacker crafts a malicious directory path or navigation parameter
3. The unsanitized input is processed by the Files application
4. The injected payload is executed or interpreted by downstream components

The attack complexity is low, requiring no user interaction beyond the attacker's own authenticated session. For technical details on the vulnerability mechanism, refer to the GitHub Security Advisory GHSA-f83q-mhrr-3cr2.

Detection Methods for CVE-2026-26002

Indicators of Compromise

• Unusual directory navigation patterns in Open OnDemand access logs containing special characters or escape sequences
• Unexpected file system access or modifications originating from the Files application
• Authentication logs showing repeated directory navigation attempts with malformed paths
• Error logs indicating input parsing failures in the Files application component

Detection Strategies

• Monitor Open OnDemand application logs for directory navigation requests containing injection payloads or special characters
• Implement web application firewall (WAF) rules to detect and block malicious input patterns targeting directory navigation
• Deploy file integrity monitoring on HPC file systems to detect unauthorized modifications
• Analyze user session behavior for anomalous directory access patterns

Monitoring Recommendations

• Enable verbose logging for the Open OnDemand Files application to capture all directory navigation requests
• Implement real-time alerting for failed input validation attempts or application errors
• Monitor network traffic for unusual patterns to and from the Open OnDemand portal
• Establish baseline behavior for directory navigation and alert on deviations

How to Mitigate CVE-2026-26002

Immediate Actions Required

• Upgrade Open OnDemand to version 4.0.9 or 4.1.3 or later immediately
• Review access logs for any suspicious directory navigation activity prior to patching
• Temporarily restrict access to the Files application if immediate patching is not possible
• Audit user accounts with access to Open OnDemand for any unauthorized activity

Patch Information

The Open OnDemand development team has released patches to address this vulnerability in versions 4.0.9 and 4.1.3. The fixes are documented in the following commits:

• GitHub Commit 23cb167
• GitHub Commit 37f0ae4

Organizations should prioritize upgrading to the patched versions. For complete details, consult the GitHub Security Advisory GHSA-f83q-mhrr-3cr2.

Workarounds

• Restrict access to the Files application to only trusted users until patching is complete
• Implement network-level access controls to limit who can reach the Open OnDemand portal
• Deploy a web application firewall (WAF) with rules to filter malicious directory navigation input
• Consider disabling the Files application entirely if it is not critical to operations until the patch can be applied

# Configuration example - Restrict access to Open OnDemand via firewall
# Allow only trusted IP ranges to access the Open OnDemand portal
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Alternatively, use Apache configuration to restrict access
# Add to your Open OnDemand Apache configuration
# <Location /pun/sys/files>
#     Require ip 10.0.0.0/8 192.168.0.0/16
# </Location>