{"id":"CVE-2026-65107","kind":"vulnerability","aliases":["CVE-2026-65107"],"related":[],"title":"NVIDIA Slurm: user can alter group list to write files they cannot access","description":"NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to.","summary":"NVIDIA Slurm, a cluster workload scheduler, has a flaw where a user can change the supplemental group list during an sbcast file transfer. An attacker can use this to write a file to a path they would not normally be allowed to reach.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hpc","infrastructure","linux","slurm"],"not_affected_if":["no-slurm"],"how_to_check":"- Check the installed Slurm version with `sinfo --version` or `slurmctld -V` and compare it to the fixed versions in the NVD entry\n- Check whether sbcast is in use on the cluster (unknown if the sources say how to confirm usage)","fix":null,"status":"open","published_at":"2026-11-03T16:17:35+00:00","first_seen_at":"2026-11-03T16:21:45+00:00","triaged_at":"2026-11-03T16:24:08+00:00","updated_at":"2026-11-03T16:24:08+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-03T16:24:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"NVIDIA Slurm: user can alter group list to write files they cannot access","impact":"medium","summary":"NVIDIA Slurm, a cluster workload scheduler, has a flaw where a user can change the supplemental group list during an sbcast file transfer. An attacker can use this to write a file to a path they would not normally be allowed to reach.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["slurm","hpc","linux"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user writes files to paths they lack access to","analyst_note":"Confirm affected and fixed Slurm versions and whether sbcast is needed for exploitation at https://nvd.nist.gov/vuln/detail/CVE-2026-65107","how_to_check":"- Check the installed Slurm version with `sinfo --version` or `slurmctld -V` and compare it to the fixed versions in the NVD entry\n- Check whether sbcast is in use on the cluster (unknown if the sources say how to confirm usage)","plain_action":"","needs_analyst":true,"not_affected_if":["no-slurm"],"who_is_affected":"Slurm clusters where users submit jobs and use sbcast to move files onto compute nodes are the exposed systems. The sources do not say which Slurm versions are affected or which configurations are required, so the team should check the NVD entry for the version ranges. Sites that do not run Slurm can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000705,"input_tokens":4231,"output_tokens":563,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-65107':16A,19A 'access':13A,100C 'allow':64B 'alter':5A,76C 'attack':48B 'cannot':12A 'chang':37B 'cluster':27B 'contain':69C 'could':75C 'cve':14A,17A 'file':10A,45B,55B,86C,91C 'flaw':32B 'group':6A,40B,79C 'hpc':20B 'infrastructur':21B 'linux':22B 'list':7A,41B,80C 'normal':62B,98C 'nvidia':1A,24B,67C 'part':82C 'path':58B,94C 'reach':66B 'sbcast':44B,85C 'schedul':29B 'slurm':2A,23B,25B,68C 'supplement':39B,78C 'transfer':46B 'transmiss':87C 'use':50B 'user':3A,35B,74C 'vulner':71C 'workload':28B 'would':60B,96C 'write':9A,53B,89C","nicknames":[],"mitigations":[],"who_affected":"Slurm clusters where users submit jobs and use sbcast to move files onto compute nodes are the exposed systems. The sources do not say which Slurm versions are affected or which configurations are required, so the team should check the NVD entry for the version ranges. Sites that do not run Slurm can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hpc","infrastructure","linux","medium","slurm"],"first_public_at":"2026-10-28T15:19:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@nvidia.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65107","severity":null,"published_at":"2026-11-03T16:17:35+00:00","modified_at":"2026-11-03T16:17:35+00:00","first_seen_at":"2026-11-03T16:21:45+00:00","fetched_at":"2026-11-03T16:21:45+00:00","note":null}],"documents":[{"id":27284,"url":"https://docs.cloud.google.com/support/bulletins/index#gcp-2026-062","title":"Google Cloud Security Bulletins: GCP-2026-062: Published: 2026-09-11 Description Description Severity Notes Multiple security vulnerabilities were discovered in Slurm that affect Cluster ","kind":"vendor","source":"vendor","publisher":null,"text":"GCP-2026-062\n\nPublished: 2026-09-11 Description Description Severity Notes Multiple security vulnerabilities were discovered in Slurm that affect Cluster Toolkit blueprints that reference specific image versions. These vulnerabilities affect the slurmstepd daemon, RPC request handling, and the accounting database. What should I do? For instructions and more details, see the Cluster Toolkit security bulletin . High CVE-2026-65107 CVE-2026-65108 CVE-2026-65109 CVE-2026-65138 CVE-2026-65139 CVE-2026-65140 CVE-2026-65165 CVE-2026-65168","published_at":"2026-10-28T15:19:22+00:00","relation":"mentions","confidence":null,"note":null},{"id":27286,"url":"https://docs.cloud.google.com/support/bulletins/index#gcp-2026-060","title":"Google Cloud Security Bulletins: GCP-2026-060: Published: 2026-09-04 Updated: 2026-09-08 Description Description Severity Notes 2026-09-08 Update: Added link to the Cluster Toolkit securi","kind":"vendor","source":"vendor","publisher":null,"text":"GCP-2026-060\n\nPublished: 2026-09-04 Updated: 2026-09-08 Description Description Severity Notes 2026-09-08 Update: Added link to the Cluster Toolkit security bulletin. A security flaw in the Slurm sbcast tool (CVE-2026-65107) lets shared library files bypass security checks and can crash nodes in your cluster. What should I do? For instructions and more details, see the following bulletins: Cluster Toolkit security bulletin Cluster Director security bulletin High CVE-2026-65107","published_at":"2026-10-28T15:19:22+00:00","relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}