Vulnerability in Osc Ondemand
CVE-2025-66029
Open OnDemand provides remote web access to supercomputers. In versions 4.0.8 and prior, the Apache proxy allows sensitive headers to be passed to origin servers. This means malicious users can create an origin server on a compute node that record these headers when unsuspecting users connect to it. Maintainers anticipate a patch in a 4.1 release. Workarounds exist for 4.0.x versions. Using `custom_location_directives` in `ood_portal.yml` in version 4.0.x (not available for versions below 4.0) centers can unset and or edit these headers. Note that `OIDCPassClaimsAs both` is the default and centers can set `OIDCPassClaimsAs ` to `none` or `environment` to stop passing these headers to the client. Centers that have an OIDC provider with the `OIDCPassClaimsAs` with `none` or `environment` settings can adjust the settings using guidance provided in GHSA-2cwp-8g29-9q32 to unset the mod_auth_openidc_session cookies.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N.
EPSS exploit prediction
EPSS: 0.002 (9.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 9th percentile — 9.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Osc Ondemand — versions <= 4.0.8
- Osc Open Ondemand
Weakness classification (CWE)
References
- github.com/OSC/ondemand/security/advisories/GHSA-2cwp-8g29-9q32 (Mitigation, Vendor Advisory)
Frequently asked questions
- What is CVE-2025-66029?
- CVE-2025-66029 is a high-severity vulnerability in Osc Ondemand, classified under Insufficiently Protected Credentials. CVSS score: 7.6/10. Published 2025-12-17.
- How severe is CVE-2025-66029?
- High severity. CVSS v3 base score is 7.6 out of 10.