CVE-2026-65140: Medium severity debian/slurm-wlm vulnerability

Q: Who is realistically exposed to this issue?

Deployments using SlurmDBD and its accounting database are exposed when a user has the Operator permission level. The affected software listed is debian/slurm-wlm.

Q: What access and conditions does an attacker need?

An attacker needs local access and high privileges, specifically Operator-level permissions in SlurmDBD. Exploitation also requires chaining inconsistent authorization checks, reflected in the high attack complexity rating.

Q: Can an Operator gain Administrator-level control?

Yes. The authorization-check inconsistency can be chained so that an Operator alters Administrator accounts and makes themselves an Administrator.

Published Nov 3, 2026

Updated

Fix a privilege escalation where an operator could alter Administrator accounts through the accounting database

Other sources

NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can be chained together in a way that would permit an Operator to make themselves an Administrator.

— MITRE

Affected Software

4 affected componentsFixes available

debian/slurm-wlm*

debian/slurm-wlm<24.11.5-4+deb13u1

24.11.5-4+deb13u1

debian/slurm-wlm<26.05.4-1

26.05.4-1

debian/slurm-wlm<=22.05.8-4+deb12u3, <=24.11.5-4

24.11.5-4+deb13u126.05.5-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/slurm-wlm to a version that resolves this vulnerability.
Fixed in 24.11.5-4+deb13u1
Upgrade
Upgrade debian/slurm-wlm to a version that resolves this vulnerability.
Fixed in 26.05.4-1
Upgrade
Upgrade debian/slurm-wlm to a version that resolves this vulnerability.
Fixed in 24.11.5-4+deb13u1Fixed in 26.05.5-1

Event History

Nov 3, 2026

CVE Published

via MITRE·03:36 PM

Data Sourced

via MITRE·03:36 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·04:17 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

DSA-6491

Frequently Asked Questions

Who is realistically exposed to this issue?

Deployments using SlurmDBD and its accounting database are exposed when a user has the Operator permission level. The affected software listed is debian/slurm-wlm.

What access and conditions does an attacker need?

An attacker needs local access and high privileges, specifically Operator-level permissions in SlurmDBD. Exploitation also requires chaining inconsistent authorization checks, reflected in the high attack complexity rating.

Can an Operator gain Administrator-level control?

Yes. The authorization-check inconsistency can be chained so that an Operator alters Administrator accounts and makes themselves an Administrator.

CVE-2026-65140: Medium severity debian/slurm-wlm vulnerability

Other sources

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who is realistically exposed to this issue?

What access and conditions does an attacker need?

Can an Operator gain Administrator-level control?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What access and conditions does an attacker need?

Can an Operator gain Administrator-level control?