CVE-2026-102894— GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover

Quick assessment

Affected

gpustack gpustack

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GPUStack 是一个用于 AI 模型服务及 GPU 实例调配的开源 GPU 集群管理器。在 0.7.1 至 2.2.2 版本中，端点在解析 SAML XML 后，直接使用其中的 NameID 和属性来解析或创建用户，并签发 gpustack_session JWT 令牌，但并未调用来验证签名、颁发者、受众、目标地址或时间条件。因此，任何网络客户端均可提交现有用户（包括管理员）的身份，或在 SAML 未配置的情况下创建新的非管理员账户。此外，由于响应和断言标识符未被消耗，已签名的响应还可被重放攻击。该问题已在

CVSS 9.1 · Critical Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1550.003 · Pass the Ticket T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover

Source: CVE Program / CVE List V5

Vulnerability Description

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用捕获-重放进行的认证绕过

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
gpustack	gpustack	>= 0.7.1, < 2.2.2	-

II. Public POCs for CVE-2026-102894

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-102894

请登录查看更多情报信息。

Other References for CVE-2026-102894 (6)

https://github.com/gpustack/gpustack/pull/5753 x_refsource_MISC
https://github.com/gpustack/gpustack/pull/5923 x_refsource_MISC
https://github.com/gpustack/gpustack/releases/tag/v2.2.2 x_refsource_MISC
https://github.com/gpustack/gpustack/security/advisories/GHSA-62m9-f875-rqw6 x_refsource_CONFIRM
https://github.com/gpustack/gpustack/commit/705edbe1b5feec63959306daecd640e1c70eced2 x_refsource_MISC
https://github.com/gpustack/gpustack/commit/adc6d82be34e48390720a1361df616e2ea9d6d45 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-102894

Same Patch Batch · gpustack · 2026-11-04 · 3 CVEs total

CVE-2026-102895	9.8 CRITICAL	GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-G
CVE-2026-103002	8.8 HIGH	GPUStack: Missing authorization on several cluster and resource endpoints allows cross-use

IV. Related Vulnerabilities

Same product: gpustack

Same vendor: gpustack

Same weakness: CWE-294