CVE-2026-102895: GPUStack Authentication Bypass — Unauthenticated Admin via Trusted Loopback Source

Background

GPUStack is an open-source GPU cluster manager used to serve AI models and provision GPU instances. Its management API controls users, models, inference backends, workers and stored provider credentials, so administrative access to it is effectively control of the GPU fleet and the secrets attached to it.

CVE-2026-102895 is an authentication bypass in versions before 2.2.0. The GitHub security advisory (GHSA-gj9m-f8ph-pmhr) states that the flaw has been observed exploited in the wild against a v2.1.1 deployment. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on 9 November 2026 with a federal due date of 12 November 2026.

Technical Mechanism

The advisory describes the root cause as trusting the network source of a request as an authentication signal. In gpustack/api/auth.py, get_current_user promotes any request whose source is considered loopback to the built-in administrator account when force_auth_localhost is False, which is the default. The source is derived by client_ip_getter, and the advisory identifies two ways to make it report 127.0.0.1 without credentials:

1. Same-host reverse proxy. With the common layout of a proxy using proxy_pass http://127.0.0.1:<port>, every remote request reaches GPUStack with a loopback TCP peer, so the auto-admin branch fires. No header or credential is needed. The advisory says this was verified end to end against commit 6bee5883.
2. Forged header. A client-supplied X-GPUStack-Real-IP: 127.0.0.1 header can cause the request source to be treated as loopback.

The CNA (GitHub) scores the issue 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The GitHub advisory lists CWE-287, CWE-290 and CWE-346; NVD (via the GitHub CNA) lists the same three CWEs.

Real-World Exploitation Evidence

• The GitHub advisory states: “This vulnerability has been observed exploited in the wild against a v2.1.1 deployment (attacker-created custom backends running reverse shells).” Active exploitation was reported by Javier Sixto (ulex.fr).
• CISA added the CVE to KEV on 9 November 2026; the due date is 12 November 2026.
• The KEV entry’s ransomware-campaign field reads “Unknown” as of 10 November 2026.
• No threat actor attribution was found in the advisory or KEV entry as of 10 November 2026.

Impact Assessment

Per the advisory, either path yields full unauthenticated administrative access over the network. An attacker can enumerate and modify users, models, workers and configuration, mint persistent admin API keys with scope ["*"] that stay valid from any source IP, and read worker credentials and cloud or provider secrets. Combined with admin-only functionality such as POST /v2/inference-backends/from-yaml, the advisory says this leads to code execution on worker hosts, which matches the reverse-shell activity it reports.

The most exposed deployments are those published through a same-host reverse proxy, because no attacker-controlled header is required. Our inference, not an advisory statement: because minted admin keys persist, patching alone may not evict an attacker who already created one.

Affected Versions

Remediation Steps

1. Upgrade GPUStack to 2.2.0 or later. The fix removes the loopback auto-admin path and hardens client-IP and forwarding-header handling.
2. If you cannot upgrade immediately, set force_auth_localhost=true so loopback requests must authenticate.
3. Make sure the reverse proxy or gateway cannot cause GPUStack to treat external traffic as loopback, and strip any client-supplied X-GPUStack-Real-IP header at the edge.
4. Keep the API off untrusted networks, for example behind a VPN or edge authentication.
5. Treat any exposed pre-2.2.0 instance as potentially compromised: review and revoke API keys, rotate worker and provider credentials, and inspect custom inference backends.

Detection Guidance

These are suggestions derived from the advisory’s description, not vendor-published signatures:

• Audit the API-key list for keys with scope * that you did not create, and for admin actions with no matching interactive login.
• Review custom inference backends, especially any created through from-yaml, for unexpected commands or shell invocations.
• Inspect reverse-proxy logs for requests carrying an X-GPUStack-Real-IP header from external clients.
• On worker hosts, look for outbound connections from GPUStack processes to unfamiliar destinations, consistent with reverse shells.

Timeline

References

• GitHub Security Advisory GHSA-gj9m-f8ph-pmhr
• GPUStack v2.2.0 release
• Fix pull request #5346
• CVE record
• NVD — CVE-2026-102895
• CISA Known Exploited Vulnerabilities Catalog