CVE-2023-49934

What it actually does

Unauthenticated SQL injection in the SlurmDBD database interface allows arbitrary SQL execution, enabling full read/write access to job, user, and accounting data.

Why it matters to the business

Attackers can steal or alter sensitive HPC workload information, disrupt cluster scheduling, and potentially pivot to broader infrastructure compromise in research and compute environments.

How an attack unfolds

An attacker sends specially crafted requests to an exposed SlurmDBD listener; the unsanitized input is concatenated into SQL statements, allowing the attacker to bypass access controls, extract credentials or job data, and execute administrative commands against the cluster database.

How to fix it

Upgrade SchedMD Slurm to version 23.11.1 or later; restrict network access to SlurmDBD ports and enable prepared-statement usage in custom clients.

How to confirm the fix worked

Confirm installed package version is 23.11.1 or newer; run automated SQL-injection test suites against the SlurmDBD interface and review database query logs for parameterized statements.

Typical attack path

1. Locate publicly reachable SlurmDBD TCP ports or misconfigured API endpoints
2. Send crafted requests containing SQL metacharacters in job submission or accounting fields
3. Extract or modify database contents including user credentials and job metadata
4. Leverage obtained data to submit malicious jobs or escalate privileges within the cluster

How to detect it

Review SlurmDBD and slurmdbd.log files for queries containing unexpected SQL keywords or unusually long input strings; correlate with network connection logs to the database port.

What your security team should do

• Immediately upgrade all 23.11.x deployments to 23.11.1
• Place SlurmDBD behind a firewall and require TLS client authentication
• Audit custom Slurm plugins and submission scripts for dynamic SQL construction
• Monitor SlurmDBD logs for anomalous query patterns