CVE-2011-4925: Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) before 2.5.9, when munge aut...

Security readout for executives and security teams

TORQUE Resource Manager before 2.5.9 can let an authenticated remote user pose as another user when MUNGE authentication is enabled. For organizations using TORQUE to schedule shared compute workloads, this can undermine job ownership, accounting, and access controls across a cluster. Exposure is likely limited to older TORQUE deployments before 2.5.9 that use MUNGE authentication. This mainly affects HPC, research, and shared compute environments where authenticated users submit or manage jobs through TORQUE. Treat this as high priority where legacy TORQUE supports shared compute workloads. The risk is account impersonation inside a trusted cluster, not broad internet compromise, but it can weaken accountability and tenant separation. Mitigation focus: Upgrade TORQUE Resource Manager to 2.5.9 or later.; Apply vendor or distribution packages that include the 2.5.9 authentication fix.; Confirm whether MUNGE authentication is enabled in TORQUE deployments..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.