Altair Grid Engine Password Hash Disclosure Vulnerability

A vulnerability exists in Altair Grid Engine versions prior to 2026.0.0, where error messages are not properly managed during user authentication. This flaw allows local attackers to access sensitive password hash information for privileged accounts, which could be exploited through offline brute-force attacks.

Impact

Exploitation of this vulnerability could lead to the extraction of password hashes for privileged accounts, allowing for offline brute-force attacks on those accounts.

Remediation

Users are advised to update Altair Grid Engine to version 2026.0.0 or later. For clusters not using the UGERest API/daemon, the setuid-root bit should be removed from the authentication user binaries. On non-Windows clusters, the setuid-root bit should be removed from the 'sgepasswd' binary.