---
id: "CVE-2026-65139"
kind: "vulnerability"
aliases: ["CVE-2026-65139"]
title: "NVIDIA Slurm: SQL injection via SlurmDBD RPCs allows arbitrary code execution"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["hpc", "infrastructure", "self-hosted", "slurm", "slurmdbd"]
not_affected_if: ["no-slurmdbd"]
published_at: "2026-11-03T16:17:35+00:00"
first_seen_at: "2026-11-03T16:21:45+00:00"
updated_at: "2026-11-03T16:24:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65139", "first_seen_at": "2026-11-03T16:21:45+00:00"}]
---

# NVIDIA Slurm: SQL injection via SlurmDBD RPCs allows arbitrary code execution

NVIDIA Slurm, a workload scheduler used on compute clusters, has an SQL injection flaw in certain SlurmDBD remote procedure calls. An attacker who can send those calls can inject SQL and, according to the description, execute arbitrary code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-03T16:21:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-65139

## Documents

- [mentions] Google Cloud Security Bulletins: GCP-2026-062: Published: 2026-09-11 Description Description Severity Notes Multiple security vulnerabilities were discovered in Slurm that affect Cluster  https://docs.cloud.google.com/support/bulletins/index#gcp-2026-062

## From the sources

NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_