CVE-2026-102895: Authentication Bypass and Admin Takeover in GPUStack

Summary

Parameter	Value
CVE ID	CVE-2026-102895
Alert Source	CISA KEV - Active Exploitation
CVE Publication Year	2026
Date Published	2026-11-09
Vendor	GPUStack
Product	GPUStack
CVSS Score	9.8 (critical)
EPSS Score	0.3% (percentile: 26%)
CISA KEV	Yes - confirmed active exploitation
Ransomware	Not confirmed
Remediation Deadline	2026-11-12

Vulnerability Description

Source: NVD, CISA KEV, GitHub Advisory GHSA-gj9m-f8ph-pmhr

GPUStack is an open-source GPU cluster manager for AI model serving (including LLMs) and GPU instance provisioning. In versions before 2.2.0, get_current_user (in gpustack/api/auth.py) treats any request whose source is a loopback address as the built-in administrator when force_auth_localhost=false, which is the default. An attacker can make a request appear local in two ways:

• same-host reverse proxy — when GPUStack sits behind a proxy forwarding to 127.0.0.1, every remote request arrives from loopback, with no header or credential required;
• X-GPUStack-Real-IP header — a forged 127.0.0.1 value in this header causes the request to be treated as local.

The result is full, unauthenticated administrative access over the network: changes to users, models and configuration, creation of persistent administrator API keys, disclosure of worker credentials and cloud-provider secrets, and — via POST /v2/inference-backends/from-yaml — code execution on worker hosts. According to the GitHub Advisory, the flaw was exploited in the wild against a v2.1.1 deployment (attackers created custom backends running reverse shells); CISA has added it to the KEV catalog.

Required Actions

• Upgrade GPUStack to 2.2.0 or later (the loopback auto-admin path was removed and client-IP handling hardened). CISA deadline for US federal agencies: 2026-11-12.
• If you cannot upgrade immediately: set force_auth_localhost=true, strip client-supplied X-GPUStack-Real-IP headers at the edge (proxy, gateway) and keep the GPUStack API off untrusted networks (VPN or edge authentication).
• Because the flaw is actively exploited, assume compromise after upgrading: review API keys and administrator accounts, revoke unknown keys, check defined inference backends for unauthorized entries, and rotate worker credentials and cloud-provider secrets stored in GPUStack.

Who Is Affected?

The vulnerability affects organizations that self-host AI models on their own GPU clusters managed by GPUStack before 2.2.0 — especially where the GPUStack UI or API is reachable through a same-host reverse proxy or directly from the network. Also check experimental environments and AI labs run by data science teams, which are often set up outside the standard vulnerability management process.

Sources

• NVD - CVE-2026-102895
• CISA KEV Catalog
• GitHub Advisory - GHSA-gj9m-f8ph-pmhr
• GPUStack 2.2.0 - release notes
• FIRST EPSS

---

Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.