MUNGE CVE-2026-25506

[garlick]

MUNGE Security Vulnerability Announcement

Recently a security vulnerability was publicly announced for MUNGE, the primary mechanism used to sign job requests in a Flux system instance.

GHSA-r9cr-jf4v-75gh

Impact Assessment

Single user Flux: Unaffected - Single user Flux doesn't make use of MUNGE at all.

System instances of Flux: Weakens security in Flux but does not create an exploitable vulnerability.

MUNGE is used to sign Flux job requests. The signature is verified by the IMP prior to execution to determine if a job request really came from the user or could have been forged by another user. Uh oh, right? Well, there is another layer of defense that saves our 🥓 here.

Two security mechanisms work together to prevent exploitation:

1. Users authenticate themselves at job submission time to the system instance brokers using UNIX domain socket peer credentials, not MUNGE. Job submissions signed with a MUNGE user ID that doesn't match the message credential user ID are immediately rejected by the job-ingest module.

2. The IMP is typically configured to only be usable by the system instance owner (normally the flux user), so only the system instance would be able to pass forged job submissions to the IMP. The IMP configuration imposes this restriction as described in flux-config-security-imp(5):

# /etc/flux/imp/conf.d/imp.toml
[exec]
allowed-users = [ "flux" ]

These two checks, working together, prevent a forged job request from being acted upon. While Flux's defense-in-depth approach prevents exploitation of this MUNGE vulnerability, administrators should still install the fixed MUNGE packages being released by Linux distributions as soon as possible.

Updating the MUNGE Key

As an additional precaution, system administrators may choose to regenerate the MUNGE key. Regenerating the MUNGE key will invalidate the signatures on all currently queued jobs. These jobs will need to be resubmitted after the new key is in place or they will fail immediately when they are launched.

Related Documentation

• Security section of the Flux Administrator's Guide
• RFC 12/Flux Role-based Access Control
• RFC 15/Independent Minister of Privilege for Flux: The Security IMP
• RFC 39/Flux Security Signature