Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-103002— GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover

Quick assessment

Affected
gpustack gpustack
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GPUStack 是一款用于 AI 模型服务及 GPU 实例供给的开源 GPU 集群管理器。在版本 2.2.0 至 2.2.2 期间， 在将经过身份验证的非管理员用户的请求转发到选定的 Kubernetes 集群时，未执行资源级别的授权检查。该代理使用了可访问的 Worker 节点所关联的 Kubernetes ServiceAccount 凭证，因此攻击者可依据该 ServiceAccount 的权限，读取敏感资源、创建或修改工作负载，甚至删除资源。利用此漏洞需要满足以下条件：目标为 Kubernetes 提供商

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-103002

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover
Source: CVE Program / CVE List V5
Vulnerability Description
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
gpustack gpustack >= 2.2.0, < 2.2.2 -

II. Public POCs for CVE-2026-103002

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-103002

请登录查看更多情报信息。

Other References for CVE-2026-103002 (6)

Same Patch Batch · gpustack · 2026-11-04 · 3 CVEs total

CVE-2026-102895 9.8 CRITICAL GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-G
CVE-2026-102894 9.1 CRITICAL GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass

IV. Related Vulnerabilities

Same product: gpustack
Same vendor: gpustack
Same weakness: CWE-639