SECURITYCRITICALCVE-2026-102895

CVE-2026-102895: GPUStack Improper Authentication Vulnerability

A critical GPUStack auth bypass (CVSS 9.8) gives unauthenticated admin access and code execution. Exploited in the wild and added to CISA KEV.

Dylan H.

Security Team

November 9, 2026
2 min read
CVE-2026-102895: GPUStack Improper Authentication Vulnerability

Actively exploited

Reported as exploited in the wild (e.g. CISA KEV). Patch or mitigate immediately.

Affected Products

  • GPUStack versions before 2.2.0

Overview

CVE-2026-102895 is a critical improper authentication vulnerability (CWE-287, CVSS 9.8) in GPUStack, an open-source GPU cluster manager used to host and serve AI models. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on November 9, 2026, with a federal remediation due date of November 12, 2026.

An unauthenticated remote attacker can obtain full administrative access to the GPUStack server.

Technical Details

In GPUStack versions before 2.2.0, the get_current_user function in gpustack/api/auth.py treated any request whose source appeared to be loopback (127.0.0.1) as the built-in administrator whenever force_auth_localhost was false, which is the default.

A remote request could be made to look local because the client_ip_getter logic trusted:

  • The TCP peer of a same-host reverse proxy, or
  • A client-supplied X-GPUStack-Real-IP header containing a loopback value

Impact

Successful exploitation allows an attacker to:

  • Change users and models
  • Create persistent administrator API keys
  • Read worker and cloud-provider secrets
  • Execute code through POST /v2/inference-backends/from-yaml

The GitHub advisory reports in-the-wild exploitation against a v2.1.1 deployment, where attackers created custom inference backends that launched reverse shells.

Affected Versions

ProductAffectedFixed
GPUStackVersions before 2.2.02.2.0 (released 2026-06-18)

Remediation

  1. Upgrade to GPUStack 2.2.0 or later. The fix commit landed on 2026-05-19.
  2. If you cannot upgrade immediately, set force_auth_localhost=true.
  3. Strip any client-supplied X-GPUStack-Real-IP header at your reverse proxy or edge.
  4. Keep the GPUStack API off untrusted networks, and place it behind a VPN or authenticating proxy.
  5. Hunt for compromise: review administrator API keys, custom inference backends created via from-yaml, and outbound connections from GPUStack hosts. Rotate any worker or cloud-provider credentials stored in GPUStack.

References

  • NVD: CVE-2026-102895
  • GitHub Security Advisory GHSA-gj9m-f8ph-pmhr
  • CISA Known Exploited Vulnerabilities Catalog