CVE-2026-102895: critical vulnerability in gpustack
GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
50Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Actcvss 9.8epss 0.3%
from disclosure to weapon
Published on NVDNov 4
VulnCheckJul 31
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
gpustack · gpustackRelated CVEs — gpustack
In the same product, most dangerous first.
CVE-2026-58658HIGHGPUStack Unauthenticated Information Disclosure via Worker EndpointsEPSS 0.5%CVE-2026-103002HIGHGPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeoverEPSS 0.4%CVE-2026-102894CRITICALGPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeoverEPSS 0.3%