CVE-2026-58658
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
GPUStack through version 2.2.1 contains an unauthenticated information disclosure vulnerability that allows attackers to access sensitive inference logs and modify worker configuration via unprotected /serveLogs and /debug endpoints on the worker port. Attackers can enumerate model instance IDs to stream serving logs containing prompts and completions, change log levels, and read memory profiling data without any authentication.
Risk Assessment
The risk for the organization includes leakage of confidential data processed by AI models (prompts and completions) and the possibility of unauthorized modification of worker configuration, which could lead to system integrity compromise and further attacks.
Recommendation
Immediately update GPUStack to a version containing commit 4e20551 or later, and restrict access to the worker port to trusted networks only.
Other vulnerabilities in GPUStack
See all- CVE-2026-103002High
In GPUStack from 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, allowing the caller to read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. This is fixed in version 2.2.2.
- CVE-2026-102895Critical
GPUStack prior to 2.2.0 treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1, allowing unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution.
- CVE-2026-102894Critical
GPUStack from 0.7.1 until 2.2.2 contains an /auth/saml/callback endpoint that decodes SAML XML and uses its NameID and attributes to resolve or provision a user without verifying the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new account, even when SAML was not configured.
Original NVD description (English source)
GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to access sensitive inference logs and modify worker configuration by exploiting unprotected /serveLogs and /debug endpoints on the worker port. Attackers can enumerate model instance IDs to stream serving logs containing prompts and completions, change log levels, and read memory profiling data without any authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS