CVE-2026-26002: Open OnDemand Path Traversal Vulnerability

CVE-2026-26002 Overview

Open OnDemand is an open-source high-performance computing (HPC) portal that provides web-based access to HPC resources. A vulnerability exists in the Files application component where malicious input can be injected when navigating to a directory. This injection vulnerability (CWE-74) allows authenticated users to potentially manipulate directory navigation behavior through crafted input.

Critical Impact
Authenticated attackers can exploit the Files application to inject malicious input during directory navigation, potentially compromising the integrity and confidentiality of HPC resources.

Affected Products

Open OnDemand versions prior to 4.0.9
Open OnDemand versions prior to 4.1.3
Open OnDemand Files application component

Discovery Timeline

2026-03-04 - CVE-2026-26002 published to NVD
2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-26002

Vulnerability Analysis

This vulnerability falls under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), commonly known as an Injection vulnerability. The Files application in Open OnDemand fails to properly validate or sanitize user-supplied input when processing directory navigation requests.

The vulnerability requires network access and low-privilege authentication to exploit. Once authenticated, an attacker can craft malicious input during directory traversal operations within the Files application interface. The impact is significant as it can affect the confidentiality, integrity, and availability of the local scope without propagating to other systems.

Organizations running HPC environments with Open OnDemand are particularly at risk, as these environments typically handle sensitive research data and computational workloads.

Root Cause

The root cause of this vulnerability lies in improper input validation within the Files application's directory navigation functionality. When a user navigates to a directory, the application fails to adequately neutralize special elements or characters in the input, allowing injection attacks. This is a classic case of trusting user input without proper sanitization, enabling attackers to inject malicious payloads that are processed by downstream components.

Attack Vector

The attack vector is network-based, requiring the attacker to have authenticated access to the Open OnDemand portal. The attack flow involves:

An authenticated user accesses the Files application within Open OnDemand
When navigating to a directory, the attacker crafts a malicious directory path or navigation parameter
The unsanitized input is processed by the Files application
The injected payload is executed or interpreted by downstream components

The attack complexity is low, requiring no user interaction beyond the attacker's own authenticated session. For technical details on the vulnerability mechanism, refer to the GitHub Security Advisory GHSA-f83q-mhrr-3cr2.

Detection Methods for CVE-2026-26002

Indicators of Compromise

Unusual directory navigation patterns in Open OnDemand access logs containing special characters or escape sequences
Unexpected file system access or modifications originating from the Files application
Authentication logs showing repeated directory navigation attempts with malformed paths
Error logs indicating input parsing failures in the Files application component

Detection Strategies

Monitor Open OnDemand application logs for directory navigation requests containing injection payloads or special characters
Implement web application firewall (WAF) rules to detect and block malicious input patterns targeting directory navigation
Deploy file integrity monitoring on HPC file systems to detect unauthorized modifications
Analyze user session behavior for anomalous directory access patterns

Monitoring Recommendations

Enable verbose logging for the Open OnDemand Files application to capture all directory navigation requests
Implement real-time alerting for failed input validation attempts or application errors
Monitor network traffic for unusual patterns to and from the Open OnDemand portal
Establish baseline behavior for directory navigation and alert on deviations

How to Mitigate CVE-2026-26002

Immediate Actions Required

Upgrade Open OnDemand to version 4.0.9 or 4.1.3 or later immediately
Review access logs for any suspicious directory navigation activity prior to patching
Temporarily restrict access to the Files application if immediate patching is not possible
Audit user accounts with access to Open OnDemand for any unauthorized activity

Patch Information

The Open OnDemand development team has released patches to address this vulnerability in versions 4.0.9 and 4.1.3. The fixes are documented in the following commits:

Organizations should prioritize upgrading to the patched versions. For complete details, consult the GitHub Security Advisory GHSA-f83q-mhrr-3cr2.

Workarounds

Restrict access to the Files application to only trusted users until patching is complete
Implement network-level access controls to limit who can reach the Open OnDemand portal
Deploy a web application firewall (WAF) with rules to filter malicious directory navigation input
Consider disabling the Files application entirely if it is not critical to operations until the patch can be applied

bash

# Configuration example - Restrict access to Open OnDemand via firewall
# Allow only trusted IP ranges to access the Open OnDemand portal
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Alternatively, use Apache configuration to restrict access
# Add to your Open OnDemand Apache configuration
# <Location /pun/sys/files>
#     Require ip 10.0.0.0/8 192.168.0.0/16
# </Location>