In plain language
What this advisory means
Google Cloud discovered multiple security vulnerabilities in Slurm, a workload manager used in cluster computing. These flaws affect certain Cluster Toolkit blueprints that rely on specific image versions. The vulnerabilities involve the slurmstepd daemon, remote procedure call (RPC) request handling, and the accounting database. Users should consult the Cluster Toolkit security bulletin for instructions and details to address these issues.
Technical explanation
How the issue affects the environment
Several security vulnerabilities were identified in Slurm, specifically impacting Cluster Toolkit blueprints that reference particular image versions. The affected components include the slurmstepd daemon, RPC request handling mechanisms, and the accounting database subsystem. These vulnerabilities could allow an attacker to exploit flaws in these components, potentially leading to unauthorized actions within the cluster environment. The advisory references multiple CVEs detailing these issues. For precise mitigation steps, users must follow guidance provided in the Cluster Toolkit security bulletin.
Operational impact
Why teams should care
Organizations using Google Cloud's Cluster Toolkit with Slurm in their HPC or cluster environment could face risks such as unauthorized access, disruption of workload management, or compromised accounting data. These vulnerabilities may affect cluster stability, data integrity, and overall security posture, potentially leading to operational disruptions and reputational damage if unaddressed.
Immediate action
Users should consult the official Cluster Toolkit security bulletin provided by Google Cloud for comprehensive instructions on how to mitigate or remediate these vulnerabilities in Slurm. This may include updating to patched image versions or applying configuration changes as recommended.
Affected and fixed releases
Temporary risk reduction
No separate workaround was supplied in the source feed. Use the official vendor advisory before changing production controls.
Evidence and validation checklist
- Multiple vulnerabilities identified in Slurm affecting Cluster Toolkit blueprints referencing specific image versions
- Impacted components include slurmstepd daemon, RPC request handling, and accounting database
- Multiple CVEs assigned: CVE-2026-65107, CVE-2026-65108, CVE-2026-65109, CVE-2026-65138, CVE-2026-65139, CVE-2026-65140, CVE-2026-65165, CVE-2026-65168
- Advisory published by Google Cloud on 2026-09-11
- Severity described as High in advisory
- Instructions to consult Cluster Toolkit security bulletin for remediation
Authoritative reference
Google Cloud Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.