LoginSign Up
← Back to all sparks
S

Slurm

DEVOPS
Velocity5.0

Workload manager and job scheduler for HPC clusters

slurm.schedmd.com ↗

Slurm coordinated a 7-CVE security drop across three active branches, including a privilege escalation and SQL injection.

hpcjob-schedulingsecurityopen-sourceinfrastructurecluster-management
◆Current state
Slurm released coordinated security patches across three active branches (25.05.x, 25.11.x, 26.05.x) fixing 7-8 CVEs per branch: sbcast credential bypass (CVE-2026-65107), slurmstepd stack overflow via SPANK environment variables (CVE-2026-65108), OCI container directory traversal (CVE-2026-65109), heap over-read in forward data RPC (CVE-2026-65138), SQL injection via cluster names in accounting queries (CVE-2026-65139), operator-to-administrator privilege escalation (CVE-2026-65140), and step distribution issues (CVE-2026-65165). The 26.05.3 patch also added support for external nodes in heterogeneous jobs — a meaningful expansion for cloud-burst HPC workflows.
◆Where it's heading
Slurm's three-branch maintenance model reflects the reality of HPC deployments: clusters running critical workloads don't upgrade quickly, so SchedMD backports security fixes to older release lines rather than forcing upgrades. The CVE density in this release cycle — particularly the accounting database SQL injection and the privilege escalation — suggests the accounting storage layer is under active security scrutiny. Feature work in 26.05.x continues on external node support and async step improvements.
◆Prediction
The accounting database SQL injection (CVE-2026-65139) will likely prompt a broader audit of user-controlled inputs to the accounting storage layer. External hetjob support in 26.05.3 will expand as cloud-burst deployments become more common in AI/HPC workloads.

◆Recent moves

  1. 13d ago

    Slurm 26.05.4: 7 CVEs patched including privilege escalation and SQL injection

    v26.05.4 closes 7 CVEs on the current release branch — including a privilege escalation (operator → admin via accounting DB) and SQL injection via cluster names — alongside the usual bug fix sweep of memory leaks, crash paths, and heterogeneous job handling. For HPC clusters with multiple user roles, the privilege escalation fix is the most operationally critical.

    View source ↗
  2. 13d ago

    Slurm 25.11.8: CVE backport security release

    v25.11.8 backports the same CVE set to the previous stable branch, plus a QOS-based preemption segfault fix. Sites running 25.11.x that cannot upgrade to 26.05 get security coverage without a major version jump — the expected pattern in Slurm's multi-branch maintenance model.

    View source ↗
  3. 13d ago

    Slurm 25.05.9: CVE backport security release

    v25.05.9 backports the CVE set to the older 25.05.x branch — the same coordinated security response as 25.11.8 and 26.05.4, ensuring sites on any of the three supported release lines receive the same security coverage simultaneously.

    View source ↗
  4. 1mo ago

    v26.05.3

    v26.05.3 adds support for external nodes in heterogeneous jobs — including batch submission via sbatch and REST interface — enabling cloud-burst HPC scenarios where some job components run on external (non-Slurm-controlled) nodes. The surrounding bug fixes address backfill correctness, licensing, JWT authentication, and a range of crash paths.

    View source ↗
  5. 2mo ago

    v26.05.2

    v26.05.2 addresses a significant burst of reliability issues: a QOS pointer dereference after assoc_mgr update, PMIx task count handling, a deadlock in the extern slurmstepd during X11 forwarding, and node-count statistics overcounting. These are the kinds of fixes that accumulated during the 26.05.0 major release ramp-up.

    View source ↗
  6. 2mo ago

    v25.11.7

    v25.11.7 resolves a QOS preemption segfault, a license-loss regression on job requeue, and an accounting storage lock contention issue causing performance regressions. The metrics endpoint redirect for standby controllers (303 → primary) is a useful operational improvement for multi-controller setups.

    View source ↗