CVE-2026-102895: GPUStack Authentication Bypass
Active exploitation confirmed in CISA KEV.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HActive exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-11-09. Federal agencies must patch by 2026-11-12.
TL;DR
- CVE-2026-102895 is a CVSS 9.8 authentication bypass affecting GPUStack versions before 2.2.0.
- Unauthenticated remote attackers may obtain administrator access when vulnerable localhost-trust logic is reachable.
- Exploitation is confirmed in the wild, and the vulnerability is listed in CISA KEV.
- Upgrade immediately, restrict administrative access, rotate exposed credentials, and investigate for compromise.
Summary
CVE-2026-102895 affects GPUStack, an open-source GPU cluster manager used for AI model serving and GPU instance provisioning. The flaw allows an unauthenticated remote attacker to make a request appear to originate from the local host. GPUStack may then treat the request as coming from its built-in administrator account.
The risk is highest for deployments exposed directly to the internet or placed behind reverse proxies. Successful exploitation can allow attackers to modify users and models, create persistent administrator API keys, disclose worker and cloud-provider secrets, and execute code through GPUStack inference-backend functionality.
Organizations should also review their broader AI infrastructure security controls and incident procedures because a compromised GPUStack instance may expose connected workers, credentials, and cloud resources.
| Field | Value |
|---|---|
| CVE | CVE-2026-102895 |
| Product | GPUStack |
| Vulnerability type | Improper authentication; authentication bypass |
| CVSS | 9.8 Critical |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Attack vector | Network |
| Authentication required | None |
| Privileges required | None |
| User interaction | None |
| Patch available | Yes |
| Fixed version | GPUStack 2.2.0 |
| CISA KEV status | Listed; added 2026-11-09 |
| Federal remediation due date | 2026-11-12 |
CISA’s Known Exploited Vulnerabilities catalog confirms exploitation in real-world attacks. The catalog lists known ransomware campaign use as Unknown. That field does not reduce the urgency: exploitation itself is confirmed, and organizations should treat vulnerable instances as potential incident-response cases rather than ordinary patching work.
Analyst’s Take: Treat this as an exposure-and-compromise problem, not only a version-management task. The authentication bypass can lead to API-key creation, secret disclosure, backend changes, and worker code execution, so teams should validate reachability and preserve evidence before assuming a clean upgrade closes the issue.
Root Cause
The vulnerability is caused by GPUStack’s trust in request origin as an authentication signal. In vulnerable versions, the get_current_user logic in gpustack/api/auth.py treated requests appearing to originate from the loopback address as the built-in administrator when force_auth_localhost was set to false, which was the default configuration.
The application did not reliably distinguish between a genuinely local request and a request whose apparent source address was produced by an intermediary or supplied through attacker-controlled request metadata. An attacker could exploit this behavior by reaching GPUStack through a same-host reverse proxy or by supplying an X-GPUStack-Real-IP header containing a loopback address such as 127.0.0.1.
This is an identity-boundary failure, not simply an exposed management interface. A network address, forwarded header, or proxy connection should not independently establish administrator identity. The vulnerable behavior effectively converted source-address metadata into an administrative credential.
The impact extends beyond unauthorized viewing. An attacker who obtains administrator context may change users and models, register or modify inference backends, create persistent API keys, access secrets, and potentially execute code on GPUStack workers through POST /v2/inference-backends/from-yaml.
Technical Notes
The relevant trust boundary involves the following conditions:
- GPUStack version is below 2.2.0.
force_auth_localhostisfalse, including the default configuration.- The administrative service is reachable by an attacker, directly or through a proxy.
- The application accepts a loopback-looking client address or untrusted
X-GPUStack-Real-IPheader.
The vendor fix removes the localhost automatic-administrator bypass and addresses trust in the client-IP header. Real-client-IP headers should only be accepted from a specifically trusted and authenticated gateway. They should never be treated as authoritative when supplied directly by arbitrary clients.
Who’s Exposed
All GPUStack versions below 2.2.0 are affected. The research record identifies the gpustack pip package as the affected package and specifically reports observed exploitation against GPUStack 2.1.1. Organizations should therefore assume that GPUStack 2.1.1 installations are high-priority targets, while recognizing that the affected range is broader than that one version.
Affected deployments may include pip-based installations, containers, research clusters, dedicated AI infrastructure, and GPUStack instances managed outside central IT. An installation may be exposed even when its service is not intentionally published to the public internet if it is reachable through a reverse proxy, load balancer, shared management network, VPN, or cloud security-group rule.
The default configuration is particularly important. The vulnerable behavior was present when force_auth_localhost: false, and that was the default setting described in the vulnerability record. Teams should not assume that an apparently internal deployment is safe merely because it is behind a proxy or bound to a private interface.
| Deployment condition | Assessment |
|---|---|
GPUStack < 2.2.0 with default configuration |
Vulnerable |
| GPUStack 2.1.1 | Specifically observed in exploitation reporting |
| GPUStack 2.2.0 or later | Fixed according to the vendor advisory |
| GPUStack behind a same-host reverse proxy | Potentially exploitable if the service is reachable |
| Internet-facing GPUStack administration | Highest priority for immediate response |
GPUStack with untrusted X-GPUStack-Real-IP handling |
High risk and requires configuration review |
Inventory should include package versions, container image tags, systemd services, Kubernetes workloads, cloud instances, and reverse-proxy routes. Version checks performed only on centrally managed hosts may miss researcher-owned or separately operated GPU clusters.
Severity Breakdown
CVE-2026-102895 has a CVSS v3.1 base score of 9.8 Critical. Its vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The components translate as follows:
| Component | Value | Meaning |
|---|---|---|
| Attack Vector | Network | Exploitation can occur remotely over a network |
| Attack Complexity | Low | No unusual conditions or sophisticated preparation are required |
| Privileges Required | None | The attacker does not need an existing account |
| User Interaction | None | No victim action is required |
| Scope | Unchanged | The vulnerable security authority remains within GPUStack |
| Confidentiality | High | Secrets and sensitive configuration may be disclosed |
| Integrity | High | Users, models, keys, and backend configuration may be modified |
| Availability | High | Services or GPU workloads may be disrupted |
The score understates some operational concerns that depend on deployment architecture. GPUStack may have access to worker hosts, model-serving infrastructure, cloud-provider credentials, and administrative API keys. The practical blast radius can therefore exceed the immediate API service, particularly where GPUStack workers have broad permissions or network access.
CISA’s KEV listing raises the priority further. The vulnerability was added on 2026-11-09, with a federal remediation due date of 2026-11-12. Known ransomware campaign use is recorded as Unknown, not confirmed. Organizations should nevertheless prioritize internet-facing and reverse-proxied installations ahead of routine critical patch queues.
Exploitation Status
Exploitation is confirmed in the wild. The NVD record reports observed exploitation against a GPUStack 2.1.1 deployment, and CISA independently lists CVE-2026-102895 in the Known Exploited Vulnerabilities catalog. This establishes active real-world exploitation even if an individual organization has not observed suspicious activity.
Reported consequences include administrative access, inference-backend registration or modification, persistent API-key creation, and code execution or reverse-shell activity on worker hosts. Because the vulnerability can be exploited without authentication or user interaction, defenders should assume that a reachable vulnerable service may already have been scanned or tested.
A standalone public proof of concept was not confirmed from the primary NVD and vendor records reviewed. Public reporting may differ on whether exploit code or demonstrations are available. That uncertainty is not a reason to delay action: exploitation is already confirmed, and the attack path is sufficiently straightforward that defenders should patch as though weaponized tooling may be available.
Technical Notes
The most valuable investigative targets are administrative actions that should normally require an authenticated GPUStack administrator, especially:
- Unexpected creation or rotation of administrator API keys.
- New or modified users and model configurations.
- Changes to inference backends.
- Requests to
POST /v2/inference-backends/from-yaml. - Requests carrying
X-GPUStack-Real-IPwith loopback values. - Administrative requests from unfamiliar source addresses or proxy paths.
The exact log format depends on the deployment and logging configuration. A generic search pattern for web-access logs is:
grep -Ei \
'X-GPUStack-Real-IP|/v2/inference-backends/from-yaml|/api/.+users|api.?key|127\\.0\\.0\\.1|::1' \
/var/log/* 2>/dev/null
For SIEM pipelines, a starting query can be adapted as follows:
http.request.headers["x-gpustack-real-ip"] IN ("127.0.0.1", "::1", "localhost")
OR url.path = "/v2/inference-backends/from-yaml"
OR (http.response.status_code IN (200, 201, 204)
AND url.path CONTAINS "api")
Treat this as a hunting seed, not a complete signature. A missing match does not demonstrate that exploitation did not occur, because logs may omit headers, use a different field name, or have been rotated. Preserve reverse-proxy, GPUStack, worker, identity, and cloud audit logs before restarting or rebuilding a suspect host.
Sources
The primary NVD record describes the vulnerability, affected versions, CVSS vector, and observed exploitation:
The vendor security advisory identifies the affected gpustack package, the fixed version, and the authentication changes:
The vendor’s remediation commit removes the localhost automatic-administrator bypass:
The associated pull request provides implementation context:
The fixed release is documented here:
CISA’s catalog confirms exploitation in the wild and records the remediation deadline:
Additional technical context is available from the following reporting, which should be evaluated alongside the primary records:
Start by identifying every reachable GPUStack instance below 2.2.0 and removing untrusted administrative access. Then upgrade, rotate credentials and secrets, and review administrative, worker, and cloud activity before returning affected systems to normal operation.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.
Detection Guidance
Begin with exposure validation. Identify every GPUStack process, package, container, service endpoint, and proxy route, then determine whether each instance is reachable from untrusted networks. Confirm the installed version rather than relying on deployment labels or documentation.
For pip-based installations, use the environment that runs GPUStack:
python -m pip show gpustack
python -m pip index versions gpustack
The installed version should be 2.2.0 or later. Package discovery alone is insufficient if multiple Python environments exist, so correlate the result with the active service command, container image, or process owner.
ps -ef | grep -i '[g]pustack'
systemctl status gpustack
Review proxy and firewall telemetry for requests to GPUStack administrative endpoints. Pay particular attention to access from the public internet, unexpected internal segments, cloud-provider address space, and requests that include client-IP headers normally added only by a trusted gateway. Search for successful responses as well as errors; an attacker may first probe with failed requests and then return after identifying a vulnerable deployment.
A practical detection workflow is:
- Export GPUStack and proxy logs for at least the period beginning before the first suspected access.
- Search for loopback values in
X-GPUStack-Real-IP. - Identify successful administrative requests without an associated authenticated session or API key.
- Review API-key creation, user changes, model changes, and backend changes.
- Compare worker process and network activity with approved deployment changes.
- Check cloud-provider audit logs for use of credentials available to GPUStack.
- Preserve evidence if unauthorized administrative activity is found.
The absence of a public PoC or a matching log line should not be interpreted as evidence of safety. CISA KEV status and observed exploitation justify containment and credential rotation even when telemetry is incomplete.
If investigation identifies unauthorized access, use a documented incident response plan to coordinate containment, evidence preservation, credential rotation, and recovery.
Remediation Steps
Upgrade every affected installation to GPUStack 2.2.0 or later. Version 2.2.0 is the documented fixed release; organizations should use the latest vendor-supported release available to them rather than stopping at the minimum version when operationally feasible.
For a pip-based installation, a direct upgrade command is:
python -m pip install --upgrade 'gpustack>=2.2.0'
python -m pip show gpustack
Use the correct virtual environment, service account environment, or container build process for the deployment. In production, update the pinned dependency or image definition, deploy through the normal change process, and verify the running process after restart. A package upgrade in an unused Python environment does not remediate the active service.
# Example verification after upgrading the active environment
python -c 'import importlib.metadata; print(importlib.metadata.version("gpustack"))'
Until the upgrade is complete, remove GPUStack administration from untrusted networks. Restrict access with firewall or security-group rules, require access through a controlled management path, and disable unnecessary reverse-proxy exposure. Do not rely solely on setting a client-IP header at the proxy: arbitrary clients must not be able to inject or override X-GPUStack-Real-IP.
The vendor remediation removes the localhost auto-administrator bypass and addresses client-IP trust. Configuration changes should therefore be treated as temporary risk reduction, not a substitute for upgrading. If a deployment cannot be upgraded immediately, isolate or discontinue the affected service where feasible, restrict it to a trusted management network, and monitor all administrative activity.
Technical Notes
A temporary containment rule should block external access to the GPUStack administration listener while permitting only an approved management network. The exact port and service binding vary by deployment, so apply the rule to the actual listener identified locally:
# Illustrative nftables pattern; replace the port and management subnet
sudo nft add rule inet filter input tcp dport <GPUSTACK_PORT> ip saddr != <TRUSTED_MGMT_SUBNET> drop
At the reverse proxy, remove client-controlled forwarding and overwrite the header only from a trusted upstream. Do not forward a value supplied by the client:
# Illustrative pattern; adapt to the actual trusted proxy topology
proxy_set_header X-GPUStack-Real-IP $remote_addr;
This is only a containment example. The proxy itself must be reachable only from trusted network paths, and the GPUStack service should not also be directly reachable from untrusted clients.
Assume credentials and secrets may have been exposed if a vulnerable instance was reachable. Rotate or revoke:
- GPUStack administrator API keys.
- User credentials associated with administrative activity.
- Worker credentials.
- Cloud-provider access keys and tokens.
- Secrets used by inference backends.
- Credentials stored in deployment manifests or configuration files.
If compromise is suspected, preserve logs and volatile evidence before rebuilding. Review persistence, new accounts, API keys, modified backend definitions, worker processes, scheduled tasks, outbound connections, and cloud audit events. Rebuild affected workers from trusted images when integrity cannot be established.