HTCONDOR-2025-0002

CVE-2025-XXXXX

Summary:

A user can submit a specially-crafted job that will run as any other non-root user after the Access Point (AP) is upgraded to a vulnerable version.

Component Vulnerable Versions Platform Availability Fix Available
Schedd daemon 24.7.3 and above All platforms Not known to be publicly exploited 24.12.14, 25.0.3, 25.3.1
Status Access Required Host Type Required Effort Required Impact/Consequences
Verified WRITE access to Schedd Submit host Low Medium
Fixed Date Credit
2025-11-03 Todd Tannenbaum
Access Required: WRITE access to Schedd

An attacker must be authorized to submit jobs to the schedd.

Effort Required: Low

The attacker must submit a specially-crafted job to the schedd, then wait for the schedd to be upgraded to a vulnerable version. No special tools are required.

Impact/Consequences Required: Medium

The attacker's specially-crafted job will be run as if it had been submitted by another non-privileged user in the pool (selected by the attacker before the upgrade).

Workaround:

An attack cannot be initiated if the AP is already running a vulnerable version. To check for potential exploit jobs, you can run this command: 

condor_q -all -constraint 'OsUser != Owner'
You can then use condor_rm to remove any suspicious jobs.

Full Details:

Embargoed until future notice.