Credential verification bypass in Slurm's sbcast facility allows broadcast of shared objects (.so files) to job-allocated nodes without proper authentication checks, potentially enabling library injection across compute nodes. A second concurrent flaw permits invalid sbcast filenames to crash the slurmd daemon, causing a denial of service on affected compute nodes. Both issues affect Slurm HPC workload manager environments where sbcast is used; the credential bypass carries the higher severity given its potential for integrity compromise across cluster nodes.
Path traversal during OCI container cleanup in Slurm's slurmstepd daemon allows files outside the designated container spool directory to be deleted on the host compute node. Affected clusters are those using Slurm's OCI container support; the bug manifests during job-step teardown, meaning any cluster user who can submit OCI-containerized jobs can trigger deletion of arbitrary files on the compute node. A secondary issue causes spool directories to be orphaned when ContainerPath includes a task ID pattern, resulting in disk resource leakage. No vendor CVSS score is published; exploitation conditions require a valid cluster account and OCI container feature enablement. No public exploit code has been identified at time of analysis.
Heap over-read and crash vulnerabilities in Slurm's slurmd compute-node daemon expose HPC clusters to memory disclosure and denial of service. When slurmd receives a malformed forward data RPC, insufficient input validation allows an attacker to trigger a heap over-read during message unpacking or crash the daemon outright if the RPC lacks a required socket address. The primary impact is availability loss on affected compute nodes; the heap over-read additionally carries a low-severity information disclosure risk. No public exploit code has been identified at time of analysis.
Privilege escalation in an Ubuntu-packaged application allows an operator-level authenticated user to modify Administrator accounts by exploiting insufficient authorization controls in the accounting database layer. The exact affected product is not determinable from available data - the description appears to be a commit-message-style changelog entry rather than a formal CVE description. No patch version, CPE string, CVSS score, or CWE identifier has been assigned, severely limiting independent verification. No public exploit has been identified at time of analysis.
CVE-2026-65165 describes unspecified issues in job step handling and node count tracking, reported via the Ubuntu vendor channel. The description '[Fix various issues around job steps and node count discrepancies]' reads as a commit message rather than a structured vulnerability disclosure, providing almost no actionable security detail. Without CVSS metrics, CWE classification, or references, the security impact - whether denial of service, privilege escalation, or incorrect resource allocation - cannot be determined from available data.