CVE Details
CVE-2026-102895
GPUStack Improper Authentication Vulnerability
Published: 2026-11-09
CVSS: 9.8 CRITICAL
Product: GPUStack GPUStack
Due Date: 2026-11-12
GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml.
GitHub PoC
Warning: GitHub PoC repositories are unverified. Some may be fake
or contain malware. Use caution and review code before running anything.
No GitHub PoC data.
FIRST EPSS
EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.
Timeline
CVE Stalker
KEV
MITRE
GitHub
FIRST (EPSS)
MITRE
CVSS
SSVC
References
Show Raw Data
| Key | Remaining Key | Value |
|---|---|---|
| dataType | CVE_RECORD | |
| dataVersion | 5.2 | |
| cveMetadata > | cveId | CVE-2026-102895 |
| cveMetadata > | assignerOrgId | a0819718-46f1-4df5-94e2-005712e83aaa |
| cveMetadata > | state | PUBLISHED |
| cveMetadata > | assignerShortName | GitHub_M |
| cveMetadata > | dateReserved | 2026-09-29T17:34:42.743Z |
| cveMetadata > | datePublished | 2026-11-04T21:16:59.842Z |
| cveMetadata > | dateUpdated | 2026-11-09T16:54:01.426Z |
| containers > | cna > title | GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin |
| containers > | cna > problemTypes > 0 > descriptions > 0 > cweId | CWE-287 |
| containers > | cna > problemTypes > 0 > descriptions > 0 > lang | en |
| containers > | cna > problemTypes > 0 > descriptions > 0 > description | CWE-287: Improper Authentication |
| containers > | cna > problemTypes > 0 > descriptions > 0 > type | CWE |
| containers > | cna > problemTypes > 1 > descriptions > 0 > cweId | CWE-290 |
| containers > | cna > problemTypes > 1 > descriptions > 0 > lang | en |
| containers > | cna > problemTypes > 1 > descriptions > 0 > description | CWE-290: Authentication Bypass by Spoofing |
| containers > | cna > problemTypes > 1 > descriptions > 0 > type | CWE |
| containers > | cna > problemTypes > 2 > descriptions > 0 > cweId | CWE-346 |
| containers > | cna > problemTypes > 2 > descriptions > 0 > lang | en |
| containers > | cna > problemTypes > 2 > descriptions > 0 > description | CWE-346: Origin Validation Error |
| containers > | cna > problemTypes > 2 > descriptions > 0 > type | CWE |
| containers > | cna > metrics > 0 > cvssV3_1 > attackComplexity | LOW |
| containers > | cna > metrics > 0 > cvssV3_1 > attackVector | NETWORK |
| containers > | cna > metrics > 0 > cvssV3_1 > availabilityImpact | HIGH |
| containers > | cna > metrics > 0 > cvssV3_1 > baseScore | 9.8 |
| containers > | cna > metrics > 0 > cvssV3_1 > baseSeverity | CRITICAL |
| containers > | cna > metrics > 0 > cvssV3_1 > confidentialityImpact | HIGH |
| containers > | cna > metrics > 0 > cvssV3_1 > integrityImpact | HIGH |
| containers > | cna > metrics > 0 > cvssV3_1 > privilegesRequired | NONE |
| containers > | cna > metrics > 0 > cvssV3_1 > scope | UNCHANGED |
| containers > | cna > metrics > 0 > cvssV3_1 > userInteraction | NONE |
| containers > | cna > metrics > 0 > cvssV3_1 > vectorString | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| containers > | cna > metrics > 0 > cvssV3_1 > version | 3.1 |
| containers > | cna > references > 0 > name | https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr |
| containers > | cna > references > 0 > tags > 0 | x_refsource_CONFIRM |
| containers > | cna > references > 0 > url | https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr |
| containers > | cna > references > 1 > name | https://github.com/gpustack/gpustack/pull/5346 |
| containers > | cna > references > 1 > tags > 0 | x_refsource_MISC |
| containers > | cna > references > 1 > url | https://github.com/gpustack/gpustack/pull/5346 |
| containers > | cna > references > 2 > name | https://github.com/gpustack/gpustack/commit/53f42a6a553542974396d16a4ff6b12bcbedb48d |
| containers > | cna > references > 2 > tags > 0 | x_refsource_MISC |
| containers > | cna > references > 2 > url | https://github.com/gpustack/gpustack/commit/53f42a6a553542974396d16a4ff6b12bcbedb48d |
| containers > | cna > references > 3 > name | https://github.com/gpustack/gpustack/releases/tag/v2.2.0 |
| containers > | cna > references > 3 > tags > 0 | x_refsource_MISC |
| containers > | cna > references > 3 > url | https://github.com/gpustack/gpustack/releases/tag/v2.2.0 |
| containers > | cna > affected > 0 > vendor | gpustack |
| containers > | cna > affected > 0 > product | gpustack |
| containers > | cna > affected > 0 > versions > 0 > version | < 2.2.0 |
| containers > | cna > affected > 0 > versions > 0 > status | affected |
| containers > | cna > providerMetadata > orgId | a0819718-46f1-4df5-94e2-005712e83aaa |
| containers > | cna > providerMetadata > shortName | GitHub_M |
| containers > | cna > providerMetadata > dateUpdated | 2026-11-04T21:16:59.842Z |
| containers > | cna > descriptions > 0 > lang | en |
| containers > | cna > descriptions > 0 > value | GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0. |
| containers > | cna > source > advisory | GHSA-gj9m-f8ph-pmhr |
| containers > | cna > source > discovery | UNKNOWN |
| containers > | adp > 0 > metrics > 0 > other > type | ssvc |
| containers > | adp > 0 > metrics > 0 > other > content > id | CVE-2026-102895 |
| containers > | adp > 0 > metrics > 0 > other > content > role | CISA Coordinator |
| containers > | adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation | active |
| containers > | adp > 0 > metrics > 0 > other > content > options > 1 > Automatable | yes |
| containers > | adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact | total |
| containers > | adp > 0 > metrics > 0 > other > content > version | 2.0.3 |
| containers > | adp > 0 > metrics > 0 > other > content > timestamp | 2026-11-09T16:50:07.009163Z |
| containers > | adp > 0 > references > 0 > url | https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102895 |
| containers > | adp > 0 > references > 0 > tags > 0 | government-resource |
| containers > | adp > 0 > title | CISA ADP Vulnrichment |
| containers > | adp > 0 > providerMetadata > orgId | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
| containers > | adp > 0 > providerMetadata > shortName | CISA-ADP |
| containers > | adp > 0 > providerMetadata > dateUpdated | 2026-11-09T16:54:01.426Z |