Live › vulnerability › CVE-2026-65107
NVIDIA Slurm, a cluster workload scheduler, has a flaw where a user can change the supplemental group list during an sbcast file transfer. An attacker can use this to write a file to a path they would not normally be allowed to reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Slurm clusters where users submit jobs and use sbcast to move files onto compute nodes are the exposed systems. The sources do not say which Slurm versions are affected or which configurations are required, so the team should check the NVD entry for the version ranges. Sites that do not run Slurm can skip it.
No product ranges from the sources yet.
sinfo --version or slurmctld -V and compare it to the fixed versions in the NVD entryNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to.
This page as .md · .json · in your agent: get_signal("CVE-2026-65107")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.