CVE-2014-8126

CVE-2014-8126 affects the HTCondor scheduler prior to version 8.2.6, where an authenticated remote user could exploit the scheduler component to execute arbitrary code. Multiple connected sources corroborate this, including OSV entries and the NVD bulletin, which describe the flaw in HTCondor and...

CVE-2021-45104

CVE-2021-45104 affects HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1. A threat actor who can capture HTCondor network traffic can interfere with users’ jobs and data. The available connected documents confirm the affected product/version range and the network-based access requirement, with ...

CVE-2022-26110

HTCondor vulnerability CVE-2022-26110 affects HTCondor 8.8.x up to 8.8.15, 9.0.x up to 9.0.9, and 9.1.x up to 9.5.x. When a user authenticates to a HTCondor daemon via CLAIMTOBE, they can impersonate another entity when issuing subsequent commands to that daemon. Root cause: misuse of CLAIMTOBE a...

CVE-2019-18823

CVE-2019-18823 affects HTCondor up to and including stable 8.8.6 and development 8.9.4, where improper access control allows impersonation of another user to condor_schedd if a READ/WRITE method includes CLAIMTOBE. This enables submitting or removing jobs without proper administrator-specified au...

CVE-2025-30093

HTCondor (HTCondor) is affected by CVE-2025-30093: authenticated attackers can bypass authorization. Affected versions are HTCondor 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before 24.6.1. The connected documents do not provide an explicit patch/fix version ...

CVE-2021-45103

HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1 contains a vulnerability where an attacker can access files stored in S3 that a user asked HTCondor to transfer. Affected version range: HTCondor 9.0.x prior to 9.0.10 and 9.1.x prior to 9.5.1. Impact: partial confidentiality and partial integri...

CVE-2017-16816

HTCondor vulnerability CVE-2017-16816 affects the condor_schedd component. Before 8.6.8 and before 8.7.5 in the 8.7.x line, remote authenticated users can cause a denial of service (daemon crash) by leveraging GSI and VOMS extensions. The issue is due to the HTCondor code paths handling these ext...

CVE-2021-25311

HTCondor’s condor_credd component (before version 8.9.11) is vulnerable to a directory traversal that escapes SEC_CREDENTIAL_DIRECTORY_OAUTH, enabling writing a file under /etc to be executed with root privileges. This CVE (CVE-2021-25311) is described consistently across multiple sources; no ven...

CVE-2012-3490

CVE-2012-3490 affects the Condor project (7.6.x before 7.6.10 and 7.8.x before 7.8.4). The vulnerability arises from not properly checking the return value of setuid in (1) my_popenv_impl, (2) my_spawnv (src/condor_utils/my_popen.cpp), and (3) systemCommand (condor_vm-gahp/vmgahp_common.cpp). Thi...

CVE-2021-25312

HTCondor before 8.9.11 is affected by CVE-2021-25312 due to a flaw in the IDTOKENS authentication method, enabling a user to submit a job as another user on the system. The available sources consistently describe the vulnerability as an authentication error in HTCondor’s IDTOKENS flow, with impac...

CVE-2021-45102

HTCondor CVE-2021-45102 affects 9.0.x before 9.0.4 and 9.1.x before 9.1.2. When authenticating to an HTCondor daemon with a SciToken, a user may gain authorizations beyond what the token should allow. Impact described as authorization escalation; no exploitation details provided. Remediation: upg...

CVE-2021-45101

The CVE-2021-45101 issue affects HTCondor before 8.8.15, 9.0.x before 9.0.4, and 9.1.x before 9.1.2. A user with only READ access to an HTCondor SchedD or Collector daemon can use standard command-line tools to discover secrets, potentially allowing them to control other users’ jobs and/or read t...