Database/Control plane, storage & DevOps
Slurm (slurmdbd accounting, Coordinator role): A Coordinator - the delegated role a site gives a team lead over their
Impact
A Coordinator - the delegated role a site gives a team lead over their own account - can promote a user to full Slurm Administrator. That collapses the boundary between per-tenant account admin and cluster-wide admin, which on a multi-tenant GPU cluster means one team's lead can rewrite every other tenant's limits, QOS and fairshare.
Who can reach it
A user holding Coordinator on any account in the accounting database. Coordinators are commonly handed out to per-project leads, so the population that can exploit this is larger than it sounds.
What to do
Upgrade to Slurm 23.11.11, 24.05.8 or 24.11.5 and restart slurmdbd. Then audit the admin level of every user in sacctmgr and revoke any Administrator grant you did not issue yourself.
References
Related entries
- HTCondor (condor_schedd / Access Point): A user plants a specially crafted job that lies dormant, then runs as aCVE-2025-66433 · HTCondor (condor_schedd / Access Point)Medium
- Sealed Secrets controller: unauthenticated template oracle recovers sealed secret plaintextCVE-2026-59341 · Bitnami Sealed Secrets controller (/v1/verify and /v1/rotate HTTP endpoints)Medium
- Apache Airflow 3.3.0-3.3.1: cookie wins over explicit bearer token, misattributing API calls and audit recordsCVE-2026-82355 · Apache Airflow core API (session cookie vs bearer token precedence)Medium
- Jenkins core: build CLI -s flag cancels other users' builds without the Item/Cancel permissionCVE-2026-84657 · Jenkins core (build CLI command, -s flag skips Item/Cancel check)Medium
- AMD IOMMU register interface - ASP coherency: Improper access control on the IOMMU register interface lets a privilegedCVE-2025-54509 · AMD IOMMU register interface - ASP coherencyMedium
- AGESA Boot Loader (ABL) - SPI ROM header input validation (AMD-SB-3003): The AGESA Boot Loader does not properlyCVE-2021-46772 · AGESA Boot Loader (ABL) - SPI ROM header input validation (AMD-SB-3003)Low
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.