{"id":"CVE-2026-65139","kind":"vulnerability","aliases":["CVE-2026-65139"],"related":[],"title":"NVIDIA Slurm: SQL injection via SlurmDBD RPCs allows arbitrary code execution","description":"NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution.","summary":"NVIDIA Slurm, a workload scheduler used on compute clusters, has an SQL injection flaw in certain SlurmDBD remote procedure calls. An attacker who can send those calls can inject SQL and, according to the description, execute arbitrary code.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hpc","infrastructure","self-hosted","slurm","slurmdbd"],"not_affected_if":["no-slurmdbd"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T16:17:35+00:00","first_seen_at":"2026-11-03T16:21:45+00:00","triaged_at":"2026-11-03T16:24:05+00:00","updated_at":"2026-11-03T16:24:05+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-03T16:24:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"NVIDIA Slurm: SQL injection via SlurmDBD RPCs allows arbitrary code execution","impact":"high","summary":"NVIDIA Slurm, a workload scheduler used on compute clusters, has an SQL injection flaw in certain SlurmDBD remote procedure calls. An attacker who can send those calls can inject SQL and, according to the description, execute arbitrary code.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["slurm","hpc","slurmdbd","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code through SQL injection in the database daemon","analyst_note":"Check NVD and NVIDIA's security bulletin for affected Slurm versions, fixed releases and whether authentication is required for the SlurmDBD RPCs.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-slurmdbd"],"who_is_affected":"Teams that run Slurm with the SlurmDBD accounting daemon, typically HPC and research clusters. Sites without SlurmDBD, or where the database RPC interface is not reachable by untrusted users, are less exposed. Sources do not state affected versions or the exact preconditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000676,"input_tokens":4155,"output_tokens":521,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-65139':14A,17A 'accord':56B 'allow':8A 'arbitrari':9A,61B,81C 'attack':46B,68C,72C 'attacker-control':67C 'call':44B,51B 'certain':40B,74C 'cluster':33B 'code':10A,62B,82C 'comput':32B 'contain':65C 'control':69C 'cve':12A,15A 'descript':59B 'execut':11A,60B,83C 'flaw':38B 'host':22B 'hpc':18B 'infrastructur':19B 'inject':4A,37B,53B,71C 'lead':79C 'nvidia':1A,25B,63C 'procedur':43B 'remot':42B 'rpcs':7A,76C 'schedul':29B 'self':21B 'self-host':20B 'send':49B 'slurm':2A,23B,26B,64C 'slurmdbd':6A,24B,41B,75C 'sql':3A,36B,54B,70C 'use':30B 'via':5A 'workload':28B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Slurm with the SlurmDBD accounting daemon, typically HPC and research clusters. Sites without SlurmDBD, or where the database RPC interface is not reachable by untrusted users, are less exposed. Sources do not state affected versions or the exact preconditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hpc","infrastructure","medium","selfhosted","slurm","slurmdbd"],"campaign_type":null,"first_public_at":"2026-10-28T15:19:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"psirt@nvidia.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65139","severity":null,"published_at":"2026-11-03T16:17:35+00:00","modified_at":"2026-11-03T16:17:35+00:00","first_seen_at":"2026-11-03T16:21:45+00:00","fetched_at":"2026-11-03T16:21:45+00:00","note":null}],"documents":[{"id":27284,"url":"https://docs.cloud.google.com/support/bulletins/index#gcp-2026-062","title":"Google Cloud Security Bulletins: GCP-2026-062: Published: 2026-09-11 Description Description Severity Notes Multiple security vulnerabilities were discovered in Slurm that affect Cluster ","kind":"vendor","source":"vendor","publisher":null,"text":"GCP-2026-062\n\nPublished: 2026-09-11 Description Description Severity Notes Multiple security vulnerabilities were discovered in Slurm that affect Cluster Toolkit blueprints that reference specific image versions. These vulnerabilities affect the slurmstepd daemon, RPC request handling, and the accounting database. What should I do? For instructions and more details, see the Cluster Toolkit security bulletin . High CVE-2026-65107 CVE-2026-65108 CVE-2026-65109 CVE-2026-65138 CVE-2026-65139 CVE-2026-65140 CVE-2026-65165 CVE-2026-65168","published_at":"2026-10-28T15:19:22+00:00","relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}