Is CVE-2026-65107 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65107 being exploited in the wild.

How severe is CVE-2026-65107?

High severity, with a CVSS score of 6.3, published 3 November 2026.

Is there a fix for CVE-2026-65107?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-65107 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-65107?

Check whether you run Google Cloud Platform or Slurm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65107: Slurm multiple vulnerabilities in Cluster Toolkit

CVE-2026-65107 · Severity: high · CVSS 6.3 · Published 2026-11-03

Multiple critical security vulnerabilities were discovered in Slurm, a widely-used job scheduling and resource management system for high-performance computing clusters. These vulnerabilities affect the slurmstepd daemon, RPC request handling, and the accounting database in Google Cloud's Cluster Toolkit. Exploitation could allow attackers to execute unauthorized code, escalate privileges, or disrupt cluster operations.

Technologies: Google Cloud Platform. Vendors: Google.

Quick answers

Is CVE-2026-65107 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65107 being exploited in the wild.
How severe is CVE-2026-65107?: High severity, with a CVSS score of 6.3, published 3 November 2026.
Which products and versions are affected?: Slurm <UNKNOWN>.
Is there a fix for CVE-2026-65107?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-65107 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-65107?: Check whether you run Google Cloud Platform or Slurm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple vulnerabilities were discovered in Slurm affecting critical components: the slurmstepd daemon (which manages job step execution), RPC request handling (for inter-node communication), and the accounting database. The vulnerabilities span eight CVEs (CVE-2026-65107, CVE-2026-65108, CVE-2026-65109, CVE-2026-65138, CVE-2026-65139, CVE-2026-65140, CVE-2026-65165, CVE-2026-65168) and include issues such as shared library bypass in the sbcast tool and flaws in daemon communication protocols. These issues affect Slurm installations deployed via Google Cloud's Cluster Toolkit when using specific vulnerable image versions. Fixes are available through updated Cluster Toolkit blueprints and patched Slurm versions.

Affected products

SchedMD Slurm Multiple versions affected (specific versions referenced in Cluster Toolkit blueprints)

Timeline

2026-09-11: disclosed: GCP-2026-062 published; GCP-2026-060 published earlier on 2026-09-04 referencing CVE-2026-65107

References

https://docs.cloud.google.com/support/bulletins/index

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.