CVE-2025-66029
Unknown Unknown - Not Provided
Header Exposure Vulnerability in Open OnDemand Apache Proxy

Publication date: 2025-12-17

Last updated on: 2026-02-18

Assigner: GitHub, Inc.

Description
Open OnDemand provides remote web access to supercomputers. In versions 4.0.8 and prior, the Apache proxy allows sensitive headers to be passed to origin servers. This means malicious users can create an origin server on a compute node that record these headers when unsuspecting users connect to it. Maintainers anticipate a patch in a 4.1 release. Workarounds exist for 4.0.x versions. Using `custom_location_directives` in `ood_portal.yml` in version 4.0.x (not available for versions below 4.0) centers can unset and or edit these headers. Note that `OIDCPassClaimsAs both` is the default and centers can set `OIDCPassClaimsAs ` to `none` or `environment` to stop passing these headers to the client. Centers that have an OIDC provider with the `OIDCPassClaimsAs` with `none` or `environment` settings can adjust the settings using guidance provided in GHSA-2cwp-8g29-9q32 to unset the mod_auth_openidc_session cookies.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-17
Last Modified
2026-02-18
Generated
2026-06-16
AI Q&A
2025-12-18
EPSS Evaluated
2026-06-15
NVD
CVE-2025-66029
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
osc open_ondemand to 4.0.8 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-523 Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in Open OnDemand versions 4.0.8 and prior involves the Apache proxy allowing sensitive headers to be passed to origin servers. Malicious users can exploit this by creating an origin server on a compute node that records these sensitive headers when unsuspecting users connect to it. This can expose sensitive information through these headers.

Impact Analysis

The vulnerability can lead to exposure of sensitive information contained in headers to malicious origin servers set up by attackers. This can compromise confidentiality (high impact on confidentiality), potentially allowing attackers to gather sensitive data from users connecting to the system. The CVSS score indicates a significant impact on confidentiality and some impact on integrity, but no impact on availability.

Mitigation Strategies

To mitigate this vulnerability in Open OnDemand versions 4.0.x, you can use the `custom_location_directives` in the `ood_portal.yml` configuration file to unset or edit sensitive headers passed by the Apache proxy. Additionally, adjust the `OIDCPassClaimsAs` setting from its default `both` to either `none` or `environment` to stop passing these headers to the client. If your center uses an OIDC provider with `OIDCPassClaimsAs` set to `none` or `environment`, follow the guidance in GHSA-2cwp-8g29-9q32 to unset the `mod_auth_openidc_session` cookies. A patch is anticipated in the 4.1 release, so plan to upgrade when available.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-66029. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart