Slurm
by Nvidia
CVEs (8)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-65168 | Hig | 0.45 | 7.0 | — | Nov 3, 2026 | NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code. | ||
| CVE-2026-65139 | Med | 0.41 | 6.3 | — | Nov 3, 2026 | NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution. | ||
| CVE-2026-65138 | Med | 0.41 | 6.3 | — | Nov 3, 2026 | NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys. | ||
| CVE-2026-65108 | Med | 0.41 | 6.3 | — | Nov 3, 2026 | NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions. | ||
| CVE-2026-65107 | Med | 0.41 | 6.3 | — | Nov 3, 2026 | NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to. | ||
| CVE-2026-65140 | Med | 0.37 | 5.7 | — | Nov 3, 2026 | NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can be chained together in a way that would permit an Operator to make themselves an Administrator. | ||
| CVE-2026-65165 | Med | 0.34 | 5.3 | — | Nov 3, 2026 | NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation. | ||
| CVE-2026-65109 | Med | 0.31 | 4.7 | — | Nov 3, 2026 | NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node. |
- risk 0.45cvss 7.0epss —
NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.
- risk 0.41cvss 6.3epss —
NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution.
- risk 0.41cvss 6.3epss —
NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys.
- risk 0.41cvss 6.3epss —
NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions.
- risk 0.41cvss 6.3epss —
NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to.
- risk 0.37cvss 5.7epss —
NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can be chained together in a way that would permit an Operator to make themselves an Administrator.
- risk 0.34cvss 5.3epss —
NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation.
- risk 0.31cvss 4.7epss —
NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node.