Date: 2026-02-12 Updated: 2026-03-24, 2026-05-12
UPDATE 2026-03-24
This is now fixed in the popular distributions, therefore if you have not already patched please do so.
CRITICAL risk buffer overflow vulnerability concerning MUNGE allowing key leakage and credential forgery. This may lead to privilege escalation. [R 1]
EGI SVG ID : EGI-SVG-2026-04
CVE ID : CVE-2026-25506
CVSS Score : 7.7 [R 2]
MUNGE versions 0.5 to 0.5.17.
Fixed in 0.5.18.
Update munge and associated packages to 0.5.18 and restart munged. If you have not done so already.
All running resources MUST be either patched or have mitigation in place or software removed by 2026-04-01 00:00 UTC
Sites failing to act or respond to requests from the EGI CSIRT team risk site suspension.
See [R 98]
Update munge and associated packages to 0.5.18 and restart munged, using references below.
Sites have successfully upgraded to 0.5.18 by building their own packages from source. [R 4]
For SLURM, a mitigation is to switch to auth/slurm authentication, but this requires the cluster to have no active jobs running.
Also see [R 1]
EGI SVG considers this vulnerability to be ‘CRITICAL’ risk because it potentially allows privilege escalation, and a proof of concept exploit has been developed.
Most SLURM installations depend on MUNGE. Also PBS/Torque and HTCondor can be configured to use MUNGE.
TLP:CLEAR information - Unlimited distribution
https://advisories.egi.eu/Advisory-EGI-SVG-2026-04
https://advisories.egi.eu/Advisory-SVG-CVE-2026-25506
Minor updates may be made without re-distribution to the sites.
This advisory is subject to the Creative Commons licence
https://creativecommons.org/licenses/by/4.0/ and
the EGI (https://www.egi.eu/) Software Vulnerability Group
must be credited. ---------
Comments or questions should be sent to svg-rat at mailman.egi.eu
Vulnerabilities relevant for EGI can be reported at report-vulnerability at egi.eu
(see [R 99] for further details, and other information on SVG)
https://github.com/dun/munge/security/advisories/GHSA-r9cr-jf4v-75gh
[R 4] https://github.com/dun/munge/releases/tag/munge-0.5.18
[R 6] https://security-tracker.debian.org/tracker/CVE-2026-25506
[R 99] https://confluence.egi.eu/display/EGIBG/SVG+Advisories
SVG was alerted to this vulnerability by Barbara Krasovec