{"id":"CVE-2026-65138","kind":"vulnerability","aliases":["CVE-2026-65138"],"related":[],"title":"NVIDIA Slurm: slurmstepd socket API lets attacker read arbitrary memory","description":"NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys.","summary":"NVIDIA Slurm's slurmstepd socket API has an arbitrary-memory read that an attacker controls. The sources say it could be used to exfiltrate authentication keys.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hpc","infrastructure","linux","slurm"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T16:17:35+00:00","first_seen_at":"2026-11-03T16:21:45+00:00","triaged_at":"2026-11-03T16:24:06+00:00","updated_at":"2026-11-03T16:24:06+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-11-03T16:24:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"NVIDIA Slurm: slurmstepd socket API lets attacker read arbitrary memory","impact":"medium","summary":"NVIDIA Slurm's slurmstepd socket API has an arbitrary-memory read that an attacker controls. The sources say it could be used to exfiltrate authentication keys.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["slurm","hpc","linux"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Authentication keys could be read from process memory","analyst_note":"Check the NVD entry and NVIDIA's Slurm security bulletin for affected versions, fixed versions, and whether the socket API needs local access.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running Slurm workload managers on Linux clusters are the ones to look at. The sources do not say which Slurm versions are affected or what configuration makes the socket API reachable. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000627,"input_tokens":4156,"output_tokens":422,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-65138':13A,16A 'api':5A,26B,63C 'arbitrari':9A,30B,56C 'arbitrary-memori':29B,55C 'attack':7A,35B,53C 'attacker-control':52C 'authent':46B,72C 'contain':50C 'control':36B,54C 'could':41B,65C 'cve':11A,14A 'ex':70C 'ex-filtr':69C 'exfiltr':45B 'filtrat':71C 'hpc':17B 'infrastructur':18B 'key':47B,73C 'let':6A 'linux':19B 'memori':10A,31B,57C 'nvidia':1A,21B,48C 'read':8A,32B,58C 'say':39B 'slurm':2A,20B,22B,49C 'slurmstepd':3A,24B,61C 'socket':4A,25B,62C 'sourc':38B 'use':43B,67C","nicknames":[],"mitigations":[],"who_affected":"Teams running Slurm workload managers on Linux clusters are the ones to look at. The sources do not say which Slurm versions are affected or what configuration makes the socket API reachable. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hpc","infrastructure","linux","medium","slurm"],"first_public_at":"2026-10-28T15:19:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@nvidia.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65138","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65138","severity":null,"published_at":"2026-11-03T16:17:35+00:00","modified_at":"2026-11-03T16:17:35+00:00","first_seen_at":"2026-11-03T16:21:45+00:00","fetched_at":"2026-11-03T16:21:45+00:00","note":null}],"documents":[{"id":27284,"url":"https://docs.cloud.google.com/support/bulletins/index#gcp-2026-062","title":"Google Cloud Security Bulletins: GCP-2026-062: Published: 2026-09-11 Description Description Severity Notes Multiple security vulnerabilities were discovered in Slurm that affect Cluster ","kind":"vendor","source":"vendor","publisher":null,"text":"GCP-2026-062\n\nPublished: 2026-09-11 Description Description Severity Notes Multiple security vulnerabilities were discovered in Slurm that affect Cluster Toolkit blueprints that reference specific image versions. These vulnerabilities affect the slurmstepd daemon, RPC request handling, and the accounting database. What should I do? For instructions and more details, see the Cluster Toolkit security bulletin . High CVE-2026-65107 CVE-2026-65108 CVE-2026-65109 CVE-2026-65138 CVE-2026-65139 CVE-2026-65140 CVE-2026-65165 CVE-2026-65168","published_at":"2026-10-28T15:19:22+00:00","relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}