Multiple security vulnerabilities were discovered in Slurm that affect Cluster Toolkit blueprints that reference specific image versions. These vulnerabilities affect the slurmstepd daemon, RPC request handling, and the accounting database.

What should I do?

To mitigate these vulnerabilities, upgrade to Cluster Toolkit version v1.103.0 or later, which upgrades Slurm to version 25.11.8 and updates pinned image references.

New deployments that use the updated blueprints automatically use the patched image versions.

For existing deployments, you must destroy and recreate your VMs or cluster by using the updated blueprint. Redeploying directly to a running cluster does not update running VMs and can cause version mismatches.

What vulnerabilities are being addressed?

This bulletin resolves multiple vulnerabilities in Slurm. For more information, see the SchedMD Slurm 25.11 release notes.

• CVE-2026-65107
• CVE-2026-65108
• CVE-2026-65109
• CVE-2026-65138
• CVE-2026-65139
• CVE-2026-65140
• CVE-2026-65165
• CVE-2026-65168

A security flaw in the Slurm sbcast tool (CVE-2026-65107) lets shared library files bypass security checks and can crash nodes in your cluster.

What should I do?

Google updated the supported OS image families (Automated Cloud Images) with patches for CVE-2026-65107 on September 5, 2026. If a node has not been recreated since September 7, 2026, then the node is vulnerable. To apply the patch, do one of the following:

• Power down static nodes. Slurm recreates the node with the patched OS image when you submit new jobs.
• Reconfigure a running cluster. In the deployment blueprint for your cluster, ensure the image family points to the latest image and redeploy the cluster.

What vulnerabilities are being addressed?

Slurm CVE-2026-65107