dbcve.org
Open OndemandApplication · Osc

CVE-2025-66029

HIGH · 7.6 CVSS v3.1 Published 2025-12-17
Fix available
A fix is available. Upgrade to after 4.0.8 or later.
See remediation →
80/100
Remediation priority · High
Remotely reachable

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Open OnDemand provides remote web access to supercomputers. In versions 4.0.8 and prior, the Apache proxy allows sensitive headers to be passed to origin servers. This means malicious users can create an origin server on a compute node that record these headers when unsuspecting users connect to it. Maintainers anticipate a patch in a 4.1 release. Workarounds exist for 4.0.x versions. Using `custom_location_directives` in `ood_portal.yml` in version 4.0.x (not available for versions below 4.0) centers can unset and or edit these headers. Note that `OIDCPassClaimsAs both` is the default and centers can set `OIDCPassClaimsAs ` to `none` or `environment` to stop passing these headers to the client. Centers that have an OIDC provider with the `OIDCPassClaimsAs` with `none` or `environment` settings can adjust the settings using guidance provided in GHSA-2cwp-8g29-9q32 to unset the mod_auth_openidc_session cookies.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

The Apache proxy in Open OnDemand versions 4.0.8 and prior passes sensitive OIDC headers (including session cookies and claims) to origin servers on compute nodes. This allows a malicious user to set up a rogue origin server that captures these headers when unsuspecting users connect, potentially enabling session hijacking or credential theft.

MitigationConfigure `custom_location_directives` in `ood_portal.yml` to unset or edit sensitive headers, or change `OIDCPassClaimsAs` from the default `both` to `none` or `environment` to prevent sensitive OIDC claims from being passed to the client.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Open OndemandApplication
Affected:<= 4.0.8

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Open OnDemand version
    Check the installed package version using the system package manager (e.g., rpm -q openondemand, dpkg -l openondemand, or check /opt/ood/VERSION if present)
    Affected if The installed version is 4.0.8 or lower
  2. Verify OIDC authentication is in use
    Inspect the OOD configuration file (typically /etc/ood/config/ood_portal.yml) for OIDC-related settings such as oidc_provider, oidc_client_id, or oidc_client_secret
    Affected if OIDC authentication is configured and enabled
  3. Check OIDCPassClaimsAs setting
    Look for the OIDCPassClaimsAs directive in ood_portal.yml or the generated Apache configuration (typically /etc/httpd/conf.d/ood_portal.conf)
    Affected if OIDCPassClaimsAs is set to 'both' (the default), which passes claims as both headers and environment variables to backend servers
  4. Examine custom_location_directives for header handling
    Search ood_portal.yml for custom_location_directives and inspect whether any rules explicitly unset or filter OIDC-sensitive headers such as OIDC_CLAIM_*, OIDC_EMAIL, or session cookies
    Affected if No custom_location_directives are configured to remove sensitive OIDC headers before proxied requests reach origin servers

A user is affected if running Open OnDemand version 4.0.8 or earlier with OIDC enabled and OIDCPassClaimsAs set to 'both' without custom header filtering rules in place.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to a release after 4.0.8
Interim mitigation

Configure `custom_location_directives` in `ood_portal.yml` to unset or edit sensitive headers, or change `OIDCPassClaimsAs` from the default `both` to `none` or `environment` to prevent sensitive OIDC claims from being passed to the client.

Recommended fix High confidence

4.1 (when released - maintainers anticipate this release will contain the patch)

  1. Edit /etc/ood/config/ood_portal.yml (or the equivalent ood_portal.yml configuration file)
  2. Add or modify the OIDC configuration to set OIDCPassClaimsAs to either 'none' or 'environment' instead of the default 'both'
  3. If additional header protection is needed, use the custom_location_directives option in ood_portal.yml to unset or edit sensitive headers being passed to origin servers
  4. For unsetting mod_auth_openidc_session cookies, follow the guidance provided in GHSA-2cwp-8g29-9q32
  5. Regenerate the Apache configuration using the Open OnDemand portal generator tool (ood_portal)
  6. Restart the Apache web server to apply the changes
Caveat Setting OIDCPassClaimsAs to 'none' or 'environment' may affect applications that rely on OIDC claims being passed as headers; test thoroughly before production deployment

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Open Ondemand Scoped from the published advisory
  • Consultation3.0 h
  • Implementation4.0 h
  • Testing3.0 h
  • Review / QA2.0 h
12.0 hours of engineering $2,130
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $3,408.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-66029 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-66029 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data