Slurm (slurmdbd, AccountingStoreFlags=job_script / job_env): MULTI-TENANT ISOLATION: When the site turns on job-script

Impact

MULTI-TENANT ISOLATION: When the site turns on job-script and job-environment archival, SlurmDBD's access-control rules let a user fetch other users' job scripts and environments. Those routinely contain API keys, model-registry tokens, S3 credentials and dataset paths, so this is a credential harvest across tenants, not just metadata leakage.

Who can reach it

Any user with a Slurm account on a cluster where AccountingStoreFlags includes job_script or job_env. 21.08.0 through 21.08.3 only - the feature did not exist before 21.08.

What to do

Upgrade to Slurm 21.08.4 and restart slurmdbd. If you cannot upgrade now, remove job_script and job_env from AccountingStoreFlags and reconfigure - that removes the exposure immediately. Treat any secret that appeared in a job script or job env during the exposure window as burned and rotate it.

References