An SQL injection flaw exists in Open XDMoD versions before 10.0.3 that permits an unauthenticated attacker to run arbitrary SQL commands on the database. The vulnerability is a classic injection flaw (CWE‑89), enabling attackers to read, modify, or delete any data in the application’s database. The post‑exploitation consequence can be a complete database compromise, leading to loss of integrity, confidentiality, and availability of HPC metrics and user data.

Open XDMoD, an open‑source framework for HPC metrics, from the ubccr project. All deployments running any version earlier than 10.0.3 are affected. No other products or vendors are listed as affected.

The CVSS score of 9.3 indicates critical severity. While the EPSS score is not available, the public advisory confirms that exploitation requires no authentication or user interaction, meaning an attacker can trigger it from any network location that can reach the application. The vulnerability was patched on 2023‑08‑04, and there is no evidence of wild exploitation yet. The CISA KEV catalog does not list this issue, but the high CVSS and unauthenticated remote attack vector warrant proactive remediation.