Header Exposure Vulnerability in Open OnDemand Apache Proxy

Publication date: 2025-12-17

Last updated on: 2026-02-18

Assigner: GitHub, Inc.

Description

Open OnDemand provides remote web access to supercomputers. In versions 4.0.8 and prior, the Apache proxy allows sensitive headers to be passed to origin servers. This means malicious users can create an origin server on a compute node that record these headers when unsuspecting users connect to it. Maintainers anticipate a patch in a 4.1 release. Workarounds exist for 4.0.x versions. Using `custom_location_directives` in `ood_portal.yml` in version 4.0.x (not available for versions below 4.0) centers can unset and or edit these headers. Note that `OIDCPassClaimsAs both` is the default and centers can set `OIDCPassClaimsAs ` to `none` or `environment` to stop passing these headers to the client. Centers that have an OIDC provider with the `OIDCPassClaimsAs` with `none` or `environment` settings can adjust the settings using guidance provided in GHSA-2cwp-8g29-9q32 to unset the mod_auth_openidc_session cookies.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-17

Last Modified

2026-02-18

Generated

2026-07-06

AI Q&A

2025-12-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-66029

Affected Vendors & Products

Vendor	Product	Version / Range
osc	open_ondemand	to 4.0.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-523	Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

This vulnerability in Open OnDemand versions 4.0.8 and prior involves the Apache proxy allowing sensitive headers to be passed to origin servers. Malicious users can exploit this by creating an origin server on a compute node that records these sensitive headers when unsuspecting users connect to it. This can expose sensitive information through these headers.

Impact Analysis

The vulnerability can lead to exposure of sensitive information contained in headers to malicious origin servers set up by attackers. This can compromise confidentiality (high impact on confidentiality), potentially allowing attackers to gather sensitive data from users connecting to the system. The CVSS score indicates a significant impact on confidentiality and some impact on integrity, but no impact on availability.

Mitigation Strategies

To mitigate this vulnerability in Open OnDemand versions 4.0.x, you can use the `custom_location_directives` in the `ood_portal.yml` configuration file to unset or edit sensitive headers passed by the Apache proxy. Additionally, adjust the `OIDCPassClaimsAs` setting from its default `both` to either `none` or `environment` to stop passing these headers to the client. If your center uses an OIDC provider with `OIDCPassClaimsAs` set to `none` or `environment`, follow the guidance in GHSA-2cwp-8g29-9q32 to unset the `mod_auth_openidc_session` cookies. A patch is anticipated in the 4.1 release, so plan to upgrade when available.

Hi! I’m here to help you understand CVE-2025-66029. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70