CVE-2026-65139

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-65139", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "state": "PUBLISHED", "assignerShortName": "nvidia", "dateReserved": "2026-07-21T17:16:49.701Z", "datePublished": "2026-11-03T15:35:41.246Z", "dateUpdated": "2026-11-03T18:27:08.402Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2026-11-03T15:35:41.246Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Code execution"}, {"lang": "en", "value": "Escalation of privileges"}, {"lang": "en", "value": "Data tampering"}]}], "affected": [{"vendor": "NVIDIA", "product": "Slurm", "versions": [{"status": "affected", "version": "25.05.0 through 25.05.8"}, {"status": "affected", "version": "25.11.0 through 25.11.7"}, {"status": "affected", "version": "26.05.0 through 26.05.3"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution."}]}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65139"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-65139"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "NVIDIA PSIRT"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T17:47:43.965009Z", "id": "CVE-2026-65139", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T18:27:08.402Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-65139", "assignerOrgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "state": "PUBLISHED", "assignerShortName": "nvidia", "dateReserved": "2026-07-21T17:16:49.701Z", "datePublished": "2026-11-03T15:35:41.246Z", "dateUpdated": "2026-11-03T18:27:08.402Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9576f279-3576-44b5-a4af-b9a8644b2de6", "shortName": "nvidia", "dateUpdated": "2026-11-03T15:35:41.246Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "impacts": [{"descriptions": [{"lang": "en", "value": "Code execution"}, {"lang": "en", "value": "Escalation of privileges"}, {"lang": "en", "value": "Data tampering"}]}], "affected": [{"vendor": "NVIDIA", "product": "Slurm", "versions": [{"status": "affected", "version": "25.05.0 through 25.05.8"}, {"status": "affected", "version": "25.11.0 through 25.11.7"}, {"status": "affected", "version": "26.05.0 through 26.05.3"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution."}]}], "references": [{"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65139"}, {"url": "https://www.cve.org/CVERecord?id=CVE-2026-65139"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "NVIDIA PSIRT"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-65139", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-03T17:47:43.965009Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T17:47:44.597Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Slurm", "vendor": "NVIDIA", "versions": [{"status": "affected", "version": "25.05.0 through 25.05.8"}, {"status": "affected", "version": "25.11.0 through 25.11.7"}, {"status": "affected", "version": "26.05.0 through 26.05.3"}]}], "source": "psirt@nvidia.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution."}], "id": "CVE-2026-65139", "lastModified": "2026-11-03T19:18:09.887", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.2, "source": "psirt@nvidia.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65139", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T17:47:43.965009Z", "version": "2.0.3"}}]}, "published": "2026-11-03T16:17:35.820", "references": [{"source": "psirt@nvidia.com", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65139"}, {"source": "psirt@nvidia.com", "url": "https://www.cve.org/CVERecord?id=CVE-2026-65139"}], "sourceIdentifier": "psirt@nvidia.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "psirt@nvidia.com", "type": "Secondary"}]}

{"bugzilla": {"description": "slurm: Slurm: Arbitrary code execution via SQL injection in SlurmDBD RPCs", "id": "2565936", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565936"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-89", "details": ["A flaw was found in Slurm. An authenticated local attacker can trigger an SQL injection vulnerability by sending crafted requests to certain Slurm Database Daemon (SlurmDBD) remote procedure calls (RPCs). Successful exploitation allows the attacker to execute arbitrary code on the underlying system."], "name": "CVE-2026-65139", "public_date": "2026-11-03T15:35:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-65139\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-65139"], "statement": "This vulnerability is rated as having a Moderate severity for Red Hat products because exploitation requires pre-existing local authenticated access and complex conditions to successfully inject malicious SQL through SlurmDBD RPCs. Furthermore, Slurm is not included or distributed as part of Red Hat Enterprise Linux core repositories. In third-party deployments hosted on Red Hat infrastructure, the impact remains restricted to the database accounting service and does not directly compromise the host operating system.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.05.0,25.05.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[25.11.0,25.11.7]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[26.05.0,26.05.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Slurm", "source": "cna", "vendor": "NVIDIA"}, "product": "slurm", "vendor": "nvidia"}], "created": "2026-11-03T17:00:16.617651+00:00", "title": "NVIDIA Slurm SQL Injection Allowing Arbitrary Code Execution in SlurmDBD RPCs", "updated": "2026-11-06T21:41:24.051699+00:00", "vendors": ["nvidia", "nvidia$PRODUCT$slurm"]}