Google says a high-severity flaw in Slurm’s sbcast tool can let shared-library files bypass security checks and can crash cluster nodes. Its new Cluster Toolkit guidance says any node that has not been recreated since September 7 remains vulnerable.
What changed
Google updated the operating-system images supported by Cluster Toolkit with patches for CVE-2026-65107. Upstream maintainer SchedMD says its Slurm 26.05.4, 25.11.8, and 25.05.9 releases fix shared objects skipping sbcast credential verification and a possible slurmd crash caused by invalid sbcast filenames.
The practical consequence
Updating a blueprint alone is not enough for an already-running node. Google directs Cluster Toolkit operators to recreate nodes from the patched image: static nodes can be powered down so Slurm recreates them when new jobs arrive, or operators can update the image family in the deployment blueprint and redeploy the cluster. Operators of Slurm outside Google Cloud should use their distributor’s guidance or move to an upstream fixed release rather than assuming Google’s image dates apply.
Limits of the advisory
The public Google bulletin labels the issue high severity but does not describe an observed attack, quantify affected clusters, or provide exploit prerequisites. SchedMD’s public release notice identifies the corrected behavior but does not establish that CVE-2026-65107 was exploited in the wild. Google’s September 7 node-recreation boundary is specific to its Cluster Toolkit images; other Slurm deployments have different packaging and patch timelines.
Benchmark status
No performance benchmark applies. The report is based on Google’s patch and remediation notice plus SchedMD’s fixed-version announcement; DrComps did not independently reproduce the bypass or node crash.