High
Security advisory
Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, allowing privilege escalation to root during Prolog or Epilog execution.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2017-15566
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 04:30 UTC · Revision 1
Source evidence
Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, allowing privilege escalation to root during Prolog or Epilog execution.
osv:CVE-2017-15566
Complete source record
{
"id": "b08eb1f42ceb8839cd61e6ad9c046fb9f839746df70b305a9e389f30976af824",
"url": "https://osv.dev/vulnerability/CVE-2017-15566",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2017-15566",
"summary": "Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, allowing privilege escalation to root during Prolog or Epilog execution.",
"evidence": "osv:CVE-2017-15566",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2017-15566",
"aliases": [
"CVE-2017-15566"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/schedmd/slurm",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "5e2dec13b45fd79afcfb851c834aacee9ca7f877"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:schedmd:slurm:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "16.05.11"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"slurm-16-05-10-2",
"slurm-16-05-10-1",
"slurm-16-05-9-1",
"slurm-16-05-8-1",
"slurm-16-05-7-1",
"slurm-16-05-6-1",
"slurm-16-05-5-1",
"slurm-16-05-4-1",
"slurm-16-05-3-1",
"slurm-16-05-2-1",
"slurm-16-05-1-1",
"slurm-16-05-0-1",
"slurm-16-05-0-0rc2",
"slurm-16-05-0-0rc1",
"slurm-16-05-0-0pre2",
"slurm-16-05-0-0pre1",
"slurm-15-08-0-1",
"slurm-15-08-0-0rc1",
"slurm-15-08-0-0pre6",
"slurm-15-08-0-0pre5",
"slurm-15-08-0-0pre4",
"slurm-15-08-0-0pre3",
"slurm-15-08-0-0pre2",
"slurm-15-08-0-0pre1",
"slurm-14-11-0-0rc1",
"slurm-14-11-0-0pre5",
"slurm-14-11-0-0pre4",
"slurm-14-11-0-0pre3",
"slurm-14-11-0-0pre2",
"slurm-14-11-0-0pre1",
"slurm-14-03-0-1",
"slurm-14-03-0-0rc1",
"slurm-14-03-0-0pre6",
"slurm-14-03-0-0pre5",
"slurm-13-12-0-0pre4",
"slurm-13-12-0-0pre3",
"slurm-13-12-0-0pre2",
"slurm-2-6-0-0rc2",
"slurm-2-6-0-0rc1",
"slurm-2-6-0-0pre4",
"slurm-2-6-0-0pre3",
"slurm-2-6-0-0pre2",
"slurm-2-6-0-0pre1",
"slurm-2-6-0-0-pre2",
"slurm-2-5-0-1",
"slurm-2-5-0-0-rc2",
"slurm-2-5-0-0-rc1",
"slurm-2-5-0-0-pre3",
"slurm-2-5-0-0-pre2",
"slurm-2-5-0-0-pre1",
"slurm-2-4-0-0-pre4",
"slurm-2-4-0-0-pre3",
"slurm-2-4-0-0-pre2",
"slurm-2-4-0-0-pre1",
"slurm-2-3-0-1",
"slurm-2-3-0-0-rc2",
"slurm-2-3-0-0-rc1",
"slurm-2-3-0-0-pre6"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-15566.json"
}
}
],
"modified": "2026-10-24T10:30:19.330222933Z",
"provider": "osv",
"references": [
"https://www.debian.org/security/2017/dsa-4023",
"https://www.schedmd.com/news.php?id=193#OPT_193"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:schedmd:slurm:*:*:*:*:*:*:*:*"
],
"vendor_product": "schedmd:slurm",
"extracted_events": [
{
"range": [
{
"introduced": "17.02.0"
},
{
"fixed": "17.2.09"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:schedmd:slurm:17.11.0:rc1:*:*:*:*:*:*"
],
"vendor_product": "schedmd:slurm",
"extracted_events": [
{
"range": [
{
"introduced": "17.11.0-rc1"
},
{
"last_affected": "17.11.0-rc1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2017-15566",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 429987,
"published_at": "2017-11-01T17:29:00.307+00:00"
}