CVE-2024-48936

Severity: medium (CVSS 5.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-28 · updated 2026-06-17
Weakness: CWE-863

Description

SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under other users' jobs. This is limited to jobs explicitly running with --stepmgr, or on systems that have globally enabled stepmgr via SlurmctldParameters=enable_stepmgr in their configuration.

Affected products

SchedMD Slurm: before 24.05.4 — fixed in 24.05.4

How to fix

Upgrade to a fixed version: SchedMD Slurm 24.05.4. Check the vendor advisory for mitigations.

References

https://lists.schedmd.com/mailman3/hyperkitty/list/slurm-announce%40lists.schedmd.com/message/44MFMN7R35YZFWTNO43R2754W5B5XUAI/
https://lists.schedmd.com/pipermail/slurm-announce/2024/date.html
https://www.schedmd.com/security-policy/

Get alerted when CVE-2024-48936 or the next vulnerability affects your stack