CVE-2025-43904: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-43904 is an incorrect authorization vulnerability in SchedMD Slurm's accounting system that allows a Coordinator-role user to improperly promote an unprivileged user to Administrator status. It affects Slurm versions prior to 24.11.5, 24.05.8, and 23.11.11. The CVE was received by MITRE and published on January 16, 2026. It carries a CVSS v3.1 base score of 4.2 (Medium), assigned by MITRE (Feedly, Red Hat Bugzilla).

The root cause is classified as CWE-863 (Incorrect Authorization) — the Slurm accounting subsystem fails to properly enforce authorization boundaries between the Coordinator and Administrator roles. A Coordinator, who has legitimate but limited administrative access to the accounting system, can exploit this flaw to elevate another user's privileges to the Administrator level without proper authorization checks. The attack vector is network-based, requires low privileges (Coordinator role), no user interaction, but has high attack complexity. No public proof-of-concept or detailed technical write-up has been published (Feedly, SchedMD Announce).

Successful exploitation allows a Coordinator to grant Administrator-level privileges to arbitrary user accounts within the Slurm workload manager, resulting in unauthorized administrative control over job scheduling and HPC resource management. An attacker with Administrator access could submit unauthorized jobs, manipulate resource allocations, alter system configurations, and potentially disrupt cluster operations. The confidentiality and integrity impacts are rated low, with no direct availability impact, though the privilege escalation path could enable broader compromise of HPC environments (Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to already hold a Coordinator role within the Slurm accounting system, which limits the attack surface (Feedly).

• Logs: Slurm accounting logs (sacctmgr audit logs) showing a Coordinator account modifying user privilege levels to Administrator unexpectedly; review slurmdbd.log for unauthorized AdminLevel=Administrator modifications.
• Logs: Unexpected new Administrator accounts appearing in sacctmgr list user withassoc format=User,AdminLevel output.
• Process/Command: Unusual sacctmgr modify user commands issued by Coordinator-level accounts that set AdminLevel=Administrator.
• Network: Slurm RPC traffic from Coordinator accounts to slurmdbd (default port 6819) performing privilege modification operations outside of normal administrative windows.

Organizations should upgrade Slurm to the patched versions: 24.11.5, 24.05.8, or 23.11.11 depending on their current release branch. As interim mitigations, restrict the Coordinator role to only fully trusted personnel, implement access controls limiting who can interact with the accounting system, and audit existing Administrator accounts for unauthorized elevations. Monitor slurmdbd logs for unexpected privilege changes. Debian has issued DSA-5961-1, Ubuntu has issued USN-8236-1, SUSE and Mageia have also released updated packages (SchedMD Announce, Debian Advisory, Ubuntu Advisory).

The EGI CSIRT published a dedicated advisory for this vulnerability shortly after disclosure, highlighting its relevance to HPC and research computing environments (EGI CSIRT). Multiple Linux distributions including Debian, Ubuntu, SUSE, and Mageia have issued security updates, reflecting broad ecosystem attention. Coverage has been largely routine, with no major controversy or significant social media discussion beyond standard security advisory channels.