GPUStack Improper Authentication Vulnerability
GPUStack — GPUStack
- Added to KEV catalog
- 9 November 2026
- Federal remediation due date
- 12 November 2026
- Weakness classification (CWE)
- CWE-287, CWE-290, CWE-346
AI Breakdown
What it is
GPUStack versions prior to 2.2.0 contain an authentication bypass flaw that mistakenly trusts requests appearing to originate from a local loopback address as an administrator. Attackers can exploit this remotely by manipulating specific network headers, tricking the application into granting full administrative privileges without requiring credentials. Once in, attackers can alter AI models, create persistent administrator API keys, expose cloud provider secrets, and execute arbitrary code.
Why it matters
This critical vulnerability carries a 9.8 severity score and has already been actively exploited in the wild against vulnerable deployments. Although known ransomware use is currently unknown, unauthorized administrative access allows attackers to seize control of GPU clusters and sensitive cloud credentials. The presence of active exploitation makes immediate remediation vital to prevent full infrastructure compromise.
Recommended action
Upgrade GPUStack to version 2.2.0 or later immediately to resolve the underlying authentication flaw. If patching cannot be completed right away, apply vendor mitigations, assess internet exposure, and follow CISA forensic triage and BOD 26-04 guidance. If mitigations are unavailable, discontinue use of the product or isolate affected systems from the network.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102895
NVD Technical Description
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services