Open Ondemand vulnerabilities

2 known vulnerabilities in Open Ondemand from OSC. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  ondemand: Improper Neutralization of Special Elements in Output Used by a Downstream Component

  CVE-2026-26002Mar 4, 2026OSC

  Open OnDemand is an open-source high-performance computing portal. The Files application in OnDemand versions prior to 4.0.9 and 4.1.3 is susceptible to malicious input when navigating to a directory. This has been patched in versions 4.0.9 and 4.1.3. Versions

• 7.6 High severity

  ondemand: Insufficiently Protected Credentials

  CVE-2025-66029Dec 17, 2025OSC

  Open OnDemand provides remote web access to supercomputers. In versions 4.0.8 and prior, the Apache proxy allows sensitive headers to be passed to origin servers. This means malicious users can create an origin server on a compute node that record these header