CISA added CVE-2026-102895 to its Known Exploited Vulnerabilities catalog on 9 November 2026 as 'GPUStack Improper Authentication Vulnerability', describing unauthenticated administrative access including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml; the US federal due date is 12 November 2026 and known ransomware campaign use is Unknown. (source: CISA KEV)

GPUStack advisory GHSA-gj9m-f8ph-pmhr (published 31 July 2026, Critical, CVSS 9.8) says that before v2.2.0, get_current_user promotes any request whose source is considered loopback to the built-in administrator when force_auth_localhost is False (the default). The source can be made to read 127.0.0.1 without credentials in two ways: behind a same-host reverse proxy every remote request arrives with TCP peer 127.0.0.1, or a forged X-GPUStack-Real-IP: 127.0.0.1 header.

Either path gives full unauthenticated admin over the network: users, models, workers and configuration; minting persistent admin API keys; reading worker credentials and cloud/provider secrets; and, with POST /v2/inference-backends/from-yaml, code execution on worker hosts.

The advisory says the flaw has been observed exploited in the wild against a v2.1.1 deployment (attacker-created custom backends running reverse shells), reported by Javier Sixto (ulex.fr).

Fixed in gpustack 2.2.0. (source: GPUStack advisory GHSA-gj9m-f8ph-pmhr)