CVE-2026-102895
CriticalCVSS 9.8Summary
GPUStack prior to 2.2.0 treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1, allowing unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution.
Risk Assessment
The vulnerability allows an unauthenticated attacker to gain full administrative control over the GPUStack platform, including code execution and secret disclosure. Exploitation has been observed in the wild.
Recommendation
Immediately update GPUStack to version 2.2.0. Also review logs for unauthorized administrative actions and rotate potentially exposed secrets and API keys.
Other vulnerabilities in GPUStack
See all- CVE-2026-103002High
In GPUStack from 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, allowing the caller to read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. This is fixed in version 2.2.2.
- CVE-2026-102894Critical
GPUStack from 0.7.1 until 2.2.2 contains an /auth/saml/callback endpoint that decodes SAML XML and uses its NameID and attributes to resolve or provision a user without verifying the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new account, even when SAML was not configured.
- CVE-2026-58658High
GPUStack through version 2.2.1 contains an unauthenticated information disclosure vulnerability that allows attackers to access sensitive inference logs and modify worker configuration via unprotected /serveLogs and /debug endpoints on the worker port. Attackers can enumerate model instance IDs to stream serving logs containing prompts and completions, change log levels, and read memory profiling data without any authentication.
Original NVD description (English source)
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS