CVE-2026-65107: Medium severity debian/slurm-wlm vulnerability

Q: Who can exploit this issue?

An attacker needs local access and low-level privileges on a Slurm system. The issue is relevant to users able to initiate an sbcast file transmission.

Q: What access could an attacker gain?

A user could alter the supplemental group list during an sbcast file transmission and write a file to a path they would not normally be permitted to access. The supplied severity vector indicates potential high confidentiality and integrity impact, with no availability impact.

Q: Is a default Slurm installation affected?

The provided information does not establish whether default configurations are affected. Exposure depends on use of sbcast file transmission.

Q: Are there related operational effects to watch for?

The fix also addresses a possible slurmd crash caused by invalid sbcast filenames. Systems processing sbcast transmissions may need to consider this stability issue in addition to unauthorized file-write risk.

Published Nov 3, 2026

Updated

Fix sbcast shared objects skipping credential verification, Fix possible slurmd crash on invalid sbcast filenames

Other sources

NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to.

— MITRE

Affected Software

4 affected componentsFixes available

debian/slurm-wlm*

debian/slurm-wlm<24.11.5-4+deb13u1

24.11.5-4+deb13u1

debian/slurm-wlm<26.05.4-1

26.05.4-1

debian/slurm-wlm<=22.05.8-4+deb12u3, <=24.11.5-4

24.11.5-4+deb13u126.05.5-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/slurm-wlm to a version that resolves this vulnerability.
Fixed in 24.11.5-4+deb13u1
Upgrade
Upgrade debian/slurm-wlm to a version that resolves this vulnerability.
Fixed in 26.05.4-1
Upgrade
Upgrade debian/slurm-wlm to a version that resolves this vulnerability.
Fixed in 24.11.5-4+deb13u1Fixed in 26.05.5-1

Event History

Nov 3, 2026

CVE Published

via MITRE·03:20 PM

Data Sourced

via MITRE·03:20 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6491

Frequently Asked Questions

Who can exploit this issue?

An attacker needs local access and low-level privileges on a Slurm system. The issue is relevant to users able to initiate an sbcast file transmission.

What access could an attacker gain?

A user could alter the supplemental group list during an sbcast file transmission and write a file to a path they would not normally be permitted to access. The supplied severity vector indicates potential high confidentiality and integrity impact, with no availability impact.

Is a default Slurm installation affected?

The provided information does not establish whether default configurations are affected. Exposure depends on use of sbcast file transmission.

Are there related operational effects to watch for?

The fix also addresses a possible slurmd crash caused by invalid sbcast filenames. Systems processing sbcast transmissions may need to consider this stability issue in addition to unauthorized file-write risk.

CVE-2026-65107: Medium severity debian/slurm-wlm vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who can exploit this issue?

What access could an attacker gain?

Is a default Slurm installation affected?

Are there related operational effects to watch for?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access could an attacker gain?

Is a default Slurm installation affected?

Are there related operational effects to watch for?