Vulnerability · critical · CVSS 9.8
GPUStack authentication bypass via trusted loopback source (CVE-2026-102895)
Tier B · Patch this week – Put it in the sprint
Who’s exposed: GPUStack deployments below v2.2.0 using default forceauthlocalhost setting
Tier B because: Exploited in the wild OR public exploit
Reach
Attack
Damage
Fix
Exploited in the wild · Remote, no login · Full takeover
What to do
- Upgrade GPUStack to v2.2.0 or later
The Brief
- GPUStack before v2.2.0 treats any request from a loopback source as the built-in administrator when forceauthlocalhost is False, which is the default.
- The loopback source can come from the reverse-proxy TCP peer or the X-GPUStack-Real-IP header, so a remote request can gain unauthenticated admin access.
- The issue is tracked as CVE-2026-102895 and was published in the GitHub Advisory Database on 2026-11-09.
Why it matters
Any GPUStack instance below v2.2.0 running with default settings can be taken over by an unauthenticated remote attacker who gets full administrator rights.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | Judgment: GPUStack is an ops/ML-infra tool for running and managing GPU clusters, used by developers and IT teams. |
| No | Core infrastructure | Judgment: GPUStack is a single niche cluster-management product, not software nearly every team runs. |
| No | Popular tool | Judgment: GPUStack is a specialised GPU-cluster tool, not a widely used mainstream framework or platform. |
| Yes | Exploited in the wild | CISA SSVCCISA rates exploitation of CVE-2026-102895 as active |
| No | Public exploit | GitHub Advisory Database: advisory describes the mechanism; no source says exploit code or PoC is published. |
| Yes | Remote, no login | CVSSCVE-2026-102895: CVSS 9.8 – network, no privileges, no user interaction |
| Yes | Full takeover | CVSSCVE-2026-102895: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | GitHub Advisory Database: no source reports stolen or exposed credentials, keys, configs or data. |
| No | Supply chain | GitHub Advisory Database: a normal authentication bug in legitimate code; no malicious shipping reported. |
| No | No fix yet | GitHub AdvisoryGitHub Advisory: gpustack fixed in 2.2.0 |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-102895 ↗CVSS 9.8 critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
- Exploited
- CISA rates exploitation active
- EPSS
- <1% chance of exploitation in the next 30 days · higher than 26% of all CVEs
- Fix
- gpustack (pip) fixed in 2.2.0
- Weakness
- CWE-287, CWE-290, CWE-346
Timeline
GitHub Advisory Database publishes advisory GHSA-gj9m-f8ph-pmhr
GitHub Advisory Database
GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin (CVE-2026-102895)
Source
GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin (CVE-2026-102895) ↗ GitHub Advisory Database · 2h ago
First seen · 1 source · Full story page · How tiers are decided