MUNGE (munged credential daemon): This is the root of trust under Slurm. A crafted message with an oversized

Impact

This is the root of trust under Slurm. A crafted message with an oversized address-length field overflows a buffer in munged and lets a local attacker read the MAC subkey out of the daemon's memory. With that key they forge MUNGE credentials for any identity, including root, to every service on the cluster that trusts MUNGE - which on a Slurm site is slurmctld, slurmd and slurmdbd. A researcher PoC demonstrated key extraction with ASLR, PIE, NX and RELRO all enabled.

Who can reach it

A local user on any node running munged - i.e. any tenant with a job on a compute node. The forged credentials are then usable cluster-wide, so a foothold on one node becomes authority over the whole scheduler.

What to do

Upgrade MUNGE to 0.5.18 on every node. Then regenerate the MUNGE key: stop munged cluster-wide, run mungekey --create --force as the munge user on one node, push the new key to all nodes, restart munged. Key regeneration means an all-node munged stop, so running jobs that need to re-authenticate will break - schedule a window. Patching alone is not sufficient if you believe the key was already extracted.

References

Related entries

• VMware Avi Load Balancer: local user can escalate to root on the applianceCVE-2026-47868 · VMware Avi Load Balancer (Controller and Service Engine appliance)High
• Linuxfabrik monitoring plugins: pipe injection in shell_exec escalates a check account to rootCVE-2026-55426 · Linuxfabrik Monitoring Plugins / linuxfabrik-lib (lib.shell.shell_exec)High
• Apache Storm worker-launcher: TOCTOU on the command file gives a tenant root-equivalent container launchCVE-2026-82430 · Apache Storm worker-launcher (setuid-root Docker/OCI worker launch)High
• SonicWall SMA1000: authenticated admin can inject OS commands through the management consoleCVE-2026-83549 · SonicWall SMA1000 appliance (Appliance Management Console, OS command injection)High
• Linux kernel nfsd: module init error path leaves debugfs files pointing into freed module textCVE-2026-89668 · Linux kernel nfsd (debugfs init ordering in init_nfsd)High
• CyberPower PowerPanel managed devices - shared device certificates: Every managed device uses an identical certificateCVE-2024-31410 · CyberPower PowerPanel managed devices - shared device certificatesHigh