Database/Container, Kubernetes & orchestration
Slurm: Authentication-handling mistake in stepmgr lets an attacker execute processes under other users' jobs
CVE-2024-48936Container, Kubernetes & orchestrationcurated
Impact
Authentication-handling mistake in stepmgr lets an attacker execute processes under other users' jobs; cross-tenant job compromise on a shared GPU cluster
Who can reach it
Any user who can submit a job
What to do
Upgrade Slurm to 24.05.4+; disable --stepmgr if not needed
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.