CVE-2026-102895— GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

Quick assessment

Affected

gpustack gpustack

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GPUStack 是一个用于 AI 模型服务和 GPU 实例配置的开源 GPU 集群管理器。在 2.2.0 版本之前，中的函数在为 false（即默认配置）时，会将来自回环地址（loopback）的请求源视为内置管理员。由于接受同主机反向代理对等端或客户端提供的回环值，远程请求可被伪装成源自 127.0.0.1。该绕过漏洞允许未认证的管理员访问，包括修改用户和模型、创建持久化管理员 API 密钥、泄露工作节点及云服务商凭据，并通过接口执行代码。该漏洞已在野外针对 2.1.1 版本的部署中被实际利用。此问

CVSS 9.8 · Critical Updated Nov 05, 2026

Possible ATT&CK Techniques 3 AI

T1059.006 · Python T1078.004 · Cloud Accounts T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

Source: CVE Program / CVE List V5

Vulnerability Description

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

认证机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
gpustack	gpustack	< 2.2.0	-

II. Public POCs for CVE-2026-102895

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-102895

请登录查看更多情报信息。

Other References for CVE-2026-102895 (4)

https://github.com/gpustack/gpustack/pull/5346 x_refsource_MISC
https://github.com/gpustack/gpustack/releases/tag/v2.2.0 x_refsource_MISC
https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr x_refsource_CONFIRM
https://github.com/gpustack/gpustack/commit/53f42a6a553542974396d16a4ff6b12bcbedb48d x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-102895

Same Patch Batch · gpustack · 2026-11-04 · 3 CVEs total

CVE-2026-102894	9.1 CRITICAL	GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass
CVE-2026-103002	8.8 HIGH	GPUStack: Missing authorization on several cluster and resource endpoints allows cross-use

IV. Related Vulnerabilities

Same product: gpustack

Same vendor: gpustack

Same weakness: CWE-287