Authorization Bypass Vulnerability in HTCondor Package
Summary
CVE-2025-30093: HTCondor 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before 24.6.1 allows authenticated attackers to bypass authorization restrictions. Affects condor across 2 version ranges.
< 23.9.6+dfsg-2
>= b053e1192c1240a929beea6b8a36805f2c2531a3, < b5cd07d8809fcbff792463732807f64457708d9b
Fixed in 23.9.6+dfsg-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
HTCondor is a specialized workload management system for compute-intensive jobs, enabling users to manage and schedule jobs across a network of machines. It is widely used in high-throughput computing environments. The package allows users to submit, manage, and monitor jobs efficiently. However, certain versions of HTCondor are vulnerable to an authorization bypass issue, which can lead to unauthorized access to restricted functionalities.
Vulnerability Detail
The vulnerability identified as CVE-2025-30093 affects HTCondor versions 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before 24.6.1. Authenticated attackers can exploit this vulnerability to bypass authorization restrictions, potentially allowing them to perform actions that should be restricted. This could lead to unauthorized access to sensitive data or the ability to manipulate job submissions and management.
How To Fix
Minimum fixed version
23.9.6+dfsg-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade condorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the HTCondor system by implementing stricter network controls or by limiting user permissions until the package can be updated to a secure version.
Conclusion
The CVE-2025-30093 vulnerability in HTCondor poses a significant risk by allowing authenticated attackers to bypass authorization restrictions. It is crucial for users to update their installations to the latest patched versions to mitigate this risk and ensure the security of their workload management systems.
See every vulnerability recorded for condor →
FAQ
CVE-2025-30093 is a vulnerability in HTCondor that allows authenticated attackers to bypass authorization restrictions.
HTCondor versions 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before 24.6.1 are affected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability may allow unauthorized users to access sensitive functionalities, leading to data breaches or job manipulation.
You can update the HTCondor package using the command 'sudo apt-get update && sudo apt-get install condor' to ensure you have the latest secure version.
Related vulnerabilities
Recent vulnerabilities recorded for condor.
