CVE-2026-45779: Buffalo Open XDMoD SQLi Vulnerability

CVE-2026-45779 Overview

CVE-2026-45779 is an SQL injection vulnerability [CWE-89] in Open XDMoD, an open framework for collecting and analyzing High Performance Computing (HPC) metrics. The flaw affects all versions of Open XDMoD prior to 10.0.3 and allows an unauthenticated remote attacker to execute arbitrary SQL statements against the underlying database. Exploitation requires no authentication and no user interaction. Successful attacks can result in complete compromise of the database backing the XDMoD deployment.

Critical Impact
An unauthenticated remote attacker can execute arbitrary SQL statements against Open XDMoD, leading to full compromise of the underlying database, including read, modification, and deletion of stored HPC metrics and account data.

Affected Products

Open XDMoD versions 0.0.0 through 8.6.0
Open XDMoD versions 9.0.0 through 10.0.2
All Open XDMoD deployments prior to 10.0.3

Discovery Timeline

2023-08-03 - Vulnerability discovered in Open XDMoD
2023-08-04 - Open XDMoD 10.0.3 released with the security patch
2026-06-05 - CVE-2026-45779 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-45779

Vulnerability Analysis

The vulnerability is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). Open XDMoD constructs SQL queries using attacker-controllable input without applying parameterized queries or sufficient input sanitization. An attacker can submit crafted HTTP requests to a vulnerable endpoint and inject SQL syntax that the database executes in the context of the XDMoD application user.

Because exploitation requires no authentication, any deployment of Open XDMoD reachable over the network is exposed. The database typically stores HPC job accounting records, user information, and resource usage metrics, all of which become accessible to the attacker.

Root Cause

The root cause is the construction of SQL statements using unsanitized user-supplied input. The vulnerable code path concatenates request parameters directly into SQL strings rather than binding them as parameters. The GitHub security advisory GHSA-r33r-6g3c-r992 documents the affected code paths and the corrective changes shipped in version 10.0.3.

Attack Vector

The attack vector is network-based. An attacker sends HTTP requests carrying SQL metacharacters in parameters consumed by the vulnerable endpoint. No prior credentials, session tokens, or social engineering are required. Refer to the GitHub Release v10.0.3 and the official patch files for the exact parameter handling that was changed.

No verified proof-of-concept exploit code is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is approximately 0.425%.

Detection Methods for CVE-2026-45779

Indicators of Compromise

HTTP requests to Open XDMoD endpoints containing SQL metacharacters such as ', --, UNION SELECT, OR 1=1, or ; in query string or POST body parameters.
Unexpected database errors, long-running queries, or large response payloads originating from XDMoD application database accounts.
New or modified rows in XDMoD database tables that do not correspond to legitimate HPC job ingestion or administrative activity.

Detection Strategies

Inspect web server access logs for the XDMoD virtual host and flag requests containing SQL keywords or encoded variants in user-controllable parameters.
Enable MySQL or MariaDB general query logging temporarily and review for anomalous statements that include user input concatenated into WHERE, ORDER BY, or UNION clauses.
Deploy a Web Application Firewall (WAF) rule set such as OWASP CRS in front of XDMoD to surface SQL injection attempts in real time.

Monitoring Recommendations

Monitor outbound network traffic from the XDMoD host for data exfiltration patterns following suspicious HTTP requests.
Alert on authentication attempts and privilege changes against the XDMoD database user account.
Forward web server, application, and database logs to a centralized analytics platform and correlate request parameters with database query patterns.

How to Mitigate CVE-2026-45779

Immediate Actions Required

Upgrade Open XDMoD to version 10.0.3 or later immediately on all instances.
If immediate upgrade is not possible, apply the official patches manually from the XDMoD security patches site.
Restrict network access to the XDMoD web interface to trusted management networks until patching is complete.
Audit XDMoD database accounts, rotate credentials, and review recent query logs for signs of exploitation.

Patch Information

The vulnerability is fixed in Open XDMoD 10.0.3, released on 2023-08-04. The upstream release is documented at GitHub Release v10.0.3. For deployments that cannot be upgraded to 10.0.3 directly, the project provides backportable patches: Patch for 0.0.0 to 8.6.0 and Patch for 9.0.0 to 10.0.2. Additional context is available in the GitHub Security Advisory GHSA-r33r-6g3c-r992.

Workarounds

Apply the vendor-supplied patch files manually to the affected version branch when an upgrade to 10.0.3 is not feasible.
Place a WAF in front of XDMoD with SQL injection signatures enabled to block exploitation attempts.
Limit the privileges of the XDMoD database account so it cannot read or modify unrelated schemas, reducing blast radius if exploited.

bash

# Apply the official upstream patch for Open XDMoD 9.0.0 - 10.0.2
cd /path/to/xdmod
curl -O https://open.xdmod.org/security_patches/GHSA-r33r-6g3c-r992-9_0_0-10_0_2.patch
patch -p1 < GHSA-r33r-6g3c-r992-9_0_0-10_0_2.patch

# For 0.0.0 - 8.6.0 deployments
curl -O https://open.xdmod.org/security_patches/GHSA-r33r-6g3c-r992-0_0_0-8_6_0.patch
patch -p1 < GHSA-r33r-6g3c-r992-0_0_0-8_6_0.patch