CVE-2025-66029
Header Exposure Vulnerability in Open OnDemand Apache Proxy
Publication date: 2025-12-17
Last updated on: 2026-02-18
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| osc | open_ondemand | to 4.0.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-523 | Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server. |
| CWE-522 | The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Open OnDemand versions 4.0.8 and prior involves the Apache proxy allowing sensitive headers to be passed to origin servers. Malicious users can exploit this by creating an origin server on a compute node that records these sensitive headers when unsuspecting users connect to it. This can expose sensitive information through these headers.
How can this vulnerability impact me? :
The vulnerability can lead to exposure of sensitive information contained in headers to malicious origin servers set up by attackers. This can compromise confidentiality (high impact on confidentiality), potentially allowing attackers to gather sensitive data from users connecting to the system. The CVSS score indicates a significant impact on confidentiality and some impact on integrity, but no impact on availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability in Open OnDemand versions 4.0.x, you can use the `custom_location_directives` in the `ood_portal.yml` configuration file to unset or edit sensitive headers passed by the Apache proxy. Additionally, adjust the `OIDCPassClaimsAs` setting from its default `both` to either `none` or `environment` to stop passing these headers to the client. If your center uses an OIDC provider with `OIDCPassClaimsAs` set to `none` or `environment`, follow the guidance in GHSA-2cwp-8g29-9q32 to unset the `mod_auth_openidc_session` cookies. A patch is anticipated in the 4.1 release, so plan to upgrade when available.