{"id":"CVE-2026-65165","kind":"vulnerability","aliases":["CVE-2026-65165"],"related":[],"title":"NVIDIA Slurm: user can reach compute nodes outside their job allocation","description":"NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation.","summary":"NVIDIA Slurm, the cluster job scheduler, lets a user alter the nodelist passed with the --distribution=arbitrary option. A user can use this to reach compute nodes outside their own job allocation.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["hpc","infrastructure","linux","slurm"],"not_affected_if":["no-arbitrary-distribution","single-user-cluster"],"how_to_check":"- Check the installed Slurm version with `sinfo --version` or `slurmctld -V`, then compare it to the versions listed in the NVD entry.\n- Confirm whether users can submit jobs with --distribution=arbitrary on your clusters.","fix":null,"status":"open","published_at":"2026-11-03T16:17:36+00:00","first_seen_at":"2026-11-03T16:21:45+00:00","triaged_at":"2026-11-03T16:24:17+00:00","updated_at":"2026-11-03T16:24:17+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-03T16:24:17Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"NVIDIA Slurm: user can reach compute nodes outside their job allocation","impact":"medium","summary":"NVIDIA Slurm, the cluster job scheduler, lets a user alter the nodelist passed with the --distribution=arbitrary option. A user can use this to reach compute nodes outside their own job allocation.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["slurm","hpc","linux"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"user reaches compute nodes outside their own job allocation","analyst_note":"Check the NVD entry and NVIDIA's Slurm advisory for affected and fixed versions; the sources here state neither.","how_to_check":"- Check the installed Slurm version with `sinfo --version` or `slurmctld -V`, then compare it to the versions listed in the NVD entry.\n- Confirm whether users can submit jobs with --distribution=arbitrary on your clusters.","plain_action":"","needs_analyst":true,"not_affected_if":["single-user-cluster","no-arbitrary-distribution"],"who_is_affected":"Clusters that run NVIDIA Slurm and let ordinary users submit jobs are the ones in scope. The sources do not name the affected versions, so the team has to check the installed version against NVD. Single-user clusters where every user already owns all nodes are unlikely to be affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4163,"output_tokens":548,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-65165':14A,17A 'access':75C 'alloc':11A,53B,84C 'alongsid':68C 'alter':31B,64C 'arbitrari':38B,71C 'cluster':25B 'comput':6A,47B,77C 'contain':56C 'could':62C 'current':82C 'cve':12A,15A 'deliber':63C 'distribut':37B,70C 'gain':74C 'hpc':18B 'infrastructur':19B 'job':10A,26B,52B,83C 'let':28B 'linux':20B 'node':7A,48B,78C 'nodelist':33B,67C 'nvidia':1A,22B,54C 'option':39B,72C 'outsid':8A,49B,79C 'pass':34B 'provid':66C 'reach':5A,46B 'schedul':27B 'slurm':2A,21B,23B,55C 'use':43B 'user':3A,30B,41B,61C 'vulner':58C","nicknames":[],"mitigations":[],"who_affected":"Clusters that run NVIDIA Slurm and let ordinary users submit jobs are the ones in scope. The sources do not name the affected versions, so the team has to check the installed version against NVD. Single-user clusters where every user already owns all nodes are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["hpc","infrastructure","linux","medium","slurm"],"campaign_type":null,"first_public_at":"2026-10-28T15:19:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L","cvss_by":"psirt@nvidia.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65165","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65165","severity":null,"published_at":"2026-11-03T16:17:36+00:00","modified_at":"2026-11-03T16:17:36+00:00","first_seen_at":"2026-11-03T16:21:45+00:00","fetched_at":"2026-11-03T16:21:45+00:00","note":null}],"documents":[{"id":27284,"url":"https://docs.cloud.google.com/support/bulletins/index#gcp-2026-062","title":"Google Cloud Security Bulletins: GCP-2026-062: Published: 2026-09-11 Description Description Severity Notes Multiple security vulnerabilities were discovered in Slurm that affect Cluster ","kind":"vendor","source":"vendor","publisher":null,"text":"GCP-2026-062\n\nPublished: 2026-09-11 Description Description Severity Notes Multiple security vulnerabilities were discovered in Slurm that affect Cluster Toolkit blueprints that reference specific image versions. These vulnerabilities affect the slurmstepd daemon, RPC request handling, and the accounting database. What should I do? For instructions and more details, see the Cluster Toolkit security bulletin . High CVE-2026-65107 CVE-2026-65108 CVE-2026-65109 CVE-2026-65138 CVE-2026-65139 CVE-2026-65140 CVE-2026-65165 CVE-2026-65168","published_at":"2026-10-28T15:19:22+00:00","relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}