CVE-2026-65139: SQL Injection

Q: What level of access does an attacker need?

The reported vector requires local access and low privileges. No user interaction is required.

Q: Is unauthenticated remote exploitation indicated by the available data?

No. The supplied CVSS vector identifies the attack vector as local and requires low privileges.

Published Nov 3, 2026

Updated

Fix various issues in unsafe operation/queries to the slurmdbd

Other sources

NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution.

— MITRE

Affected Software

4 affected componentsFixes available

debian/slurm-wlm*

debian/slurm-wlm<24.11.5-4+deb13u1

24.11.5-4+deb13u1

debian/slurm-wlm<26.05.4-1

26.05.4-1

debian/slurm-wlm<=22.05.8-4+deb12u3, <=24.11.5-4

24.11.5-4+deb13u126.05.5-1

Event History

Nov 3, 2026

CVE Published

via MITRE·03:35 PM

Data Sourced

via MITRE·03:35 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6491

Frequently Asked Questions

What level of access does an attacker need?

The reported vector requires local access and low privileges. No user interaction is required.

Is unauthenticated remote exploitation indicated by the available data?

No. The supplied CVSS vector identifies the attack vector as local and requires low privileges.

CVE-2026-65139: SQL Injection

Other sources

Affected Software

Event History

Parent advisories

Frequently Asked Questions

What level of access does an attacker need?

Is unauthenticated remote exploitation indicated by the available data?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

Is unauthenticated remote exploitation indicated by the available data?