Incorrect authorization in SchedMD Slurm
Priority LOW 19CWE-863Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.
Summary
In SchedMD Slurm before 24.11.5, 24.05.8, and 23.11.11, the accounting system can allow a Coordinator to promote a user to Administrator.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00254 17th percentileScored 2026-11-07
Fix Fixed Slurm (SchedMD): 23.11.11, 24.05.8, 24.11.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SchedMD | Slurm | before 23.11.11; 24 to before 24.05.8; 24.06 to before 24.11.5 | 23.11.11, 24.05.8, 24.11.5 | Patch available | CNA |
- Slurm VendorSchedMD Affected before 23.11.11; 24 to before 24.05.8; 24.06 to before 24.11.5 Fixed in 23.11.11, 24.05.8, 24.11.5 Patch available CNA
Remediation
- Fix · CNA Slurm (SchedMD) Fixed in 23.11.11, 24.05.8, 24.11.5
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2025-43904
- 2026-10-03 Alias added: GHSA-2778-hrgh-cpxw
References
More SchedMD vulnerabilities
- TI-2019-09617 SchedMD Slurm 17.11.x, 18.08.0 through 18.08.7, and 19.05.0 allows SQL Injection. CVSS 3.1CRITICAL 9.8
- TI-2019-04508 SchedMD Slurm before 17.11.13 and 18.x before 18.08.5 mishandles 32-bit systems. CVSS 3.0CRITICAL 9.8
- TI-2022-11963 SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges. CVSS 3.1CRITICAL 9.8
- TI-2020-16830 Slurm before 19.05.8 and 20.x before 20.02.6 has an RPC Buffer Overflow in the PMIx MPI plugin. CVSS 3.1CRITICAL 9.8
- TI-2018-05107 SchedMD Slurm before 17.02.10 and 17.11.x before 17.11.5 allows SQL Injection attacks against SlurmDBD. CVSS 3.0CRITICAL 9.8
- TI-2023-27304 An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-43904 · CVE Program
- CVE-2025-43904 · NVD
- FIRST EPSS
- GHSA-2778-hrgh-cpxw · GitHub Advisory Database · CC BY 4.0
- CVE-2025-43904 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences