CVE-2024-48936: SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under…

PriorityP431medium5CVSS 3.1

AVNACHPRLUINSUCLILAL

EPSS

0.34%

26.0th percentile

SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under other users' jobs. This is limited to jobs explicitly running with --stepmgr, or on systems that have globally enabled stepmgr via SlurmctldParameters=enable_stepmgr in their configuration.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
debian	slurm-wlm	< slurm-wlm 24.05.4-1 (forky)	slurm-wlm 24.05.4-1 (forky)
schedmd	slurm	< 24.05.4	24.05.4

CVSS provenance

nvdv3.15.0MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

osv5.0MEDIUM

vendor_debian5.0LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.