CVE-2026-65139 in Slurm
Summary
by MITRE • 11/03/2026
NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified within NVIDIA Slurm represents a critical security flaw located specifically within the Slurm Database Daemon, known as SlurmDBD. This component serves as the central repository for job accounting and management data in High-Performance Computing environments. The core of the issue lies in improper input validation mechanisms when processing specific Remote Procedure Call RPCs directed at this daemon. Because these RPCs handle user-submitted parameters that are subsequently used to construct database queries, they present a direct attack surface for SQL injection attacks. An attacker who can interact with these specific endpoints is able to inject malicious SQL statements into the query structure, bypassing intended logic and manipulating how data is retrieved or modified within the underlying database system.
The technical nature of this flaw allows an unauthenticated or authenticated user, depending on the configuration, to execute arbitrary commands by exploiting the lack of proper sanitization in the RPC parameters. By crafting specific payloads that exploit SQL syntax errors or logical bypasses, a sophisticated attacker can manipulate the database backend. In many modern computing environments, particularly those utilizing databases like MySQL or MariaDB which are common with Slurm deployments, successful exploitation of certain types of SQL injection vulnerabilities can lead to operating system command execution through features such as out-of-band data extraction or specific database engine functions that allow shell access. This transforms a standard data manipulation vulnerability into a severe remote code execution vector, fundamentally compromising the integrity and availability of the entire cluster management infrastructure.
The operational impact of this vulnerability is profound for any organization relying on NVIDIA Slurm for resource scheduling and job control. Successful exploitation could result in complete compromise of the database server hosting Slurm accounting information. This breach allows attackers to steal sensitive data regarding user identities, job priorities, and computational resources. More critically, achieving arbitrary code execution means an attacker can install backdoors, pivot into other network segments connected to the cluster management plane, or disrupt critical scientific computations by terminating jobs or altering resource allocations. The trust model of HPC clusters often assumes a degree of internal security; this vulnerability undermines that assumption by allowing external actors to gain deep administrative control over the scheduling infrastructure through standard RPC interfaces.
To mitigate this risk, immediate action is required to apply vendor-provided patches that address the input validation flaws in SlurmDBD RPCs. Organizations should ensure they are running a version of NVIDIA Slurm where these specific SQL injection vectors have been remediated by properly parameterizing queries and enforcing strict type checking on all incoming RPC data. In addition to patching, network segmentation strategies should be reviewed to restrict access to the SlurmDBD ports only from authorized management nodes and schedulers. Implementing Web Application Firewalls or intrusion detection systems that can identify SQL injection patterns in RPC traffic may provide an additional layer of defense while patches are being deployed. Regular security audits focusing on database interaction layers within cluster management software are essential to prevent similar vulnerabilities from persisting in production environments.
This vulnerability aligns with Common Weakness Enumeration CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. The exploitation path also correlates with MITRE ATT&CK techniques related to Initial Access via Valid Accounts and subsequent Execution through Database Commands or Remote Services. Understanding these mappings helps security teams prioritize remediation efforts based on established industry frameworks for vulnerability management and threat mitigation.