Vulnerability · critical · CVSS 9.1
GPUStack SAML authentication bypass (CVE-2026-102894)
Tier B · Patch this week – Put it in the sprint
Who’s exposed: GPUStack deployments with SAML authentication enabled
Tier B because: Full takeover OR secrets exposed OR supply chain
Reach
Attack
Damage
Fix
Remote, no login · Full takeover
The Brief
- GPUStack's SAML callback accepts a posted SAMLResponse without verifying it.
- The callback decodes the XML, reads NameID and attributes, resolves or provisions the user, and issues a gpustacksession JWT.
- The signature, issuer and audience checks in OneLoginSaml2Auth.processresponse() are never called, which enables authentication bypass and account takeover.
Why it matters
Anyone who can reach a GPUStack SAML callback may be able to log in as an existing user or create one, so operators running SAML login should treat the instance as exposed until it is patched.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | GPUStack is a server platform for ops and ML teams to run GPU clusters and LLMs. |
| No | Core infrastructure | GPUStack is a niche cluster management tool, not core infrastructure like OpenSSH or the Linux kernel. |
| No | Popular tool | GPUStack is a specialized GPU/LLM management tool, not a widely used mainstream framework or OS. |
| No | Exploited in the wild | GitHub Advisory Database: only describes the flaw; no observed attacks reported. |
| No | Public exploit | GitHub Advisory Database: only an advisory is given; no exploit code or PoC mentioned. |
| Yes | Remote, no login | CVSSCVE-2026-102894: CVSS 9.1 – network, no privileges, no user interaction |
| Yes | Full takeover | CVSSCVE-2026-102894: CVSS rates confidentiality and integrity impact high |
| No | Secrets exposed | GitHub Advisory Database: describes authentication bypass; no stolen credentials or data exposure reported. |
| No | Supply chain | GitHub Advisory Database: a SAML callback flaw; no compromised package, update or pipeline reported. |
| No | No fix yet | GitHub AdvisoryGitHub Advisory: gpustack fixed in 2.2.2 |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-102894 ↗CVSS 9.1 critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover
- Exploited
- Not in CISA’s exploited catalog
- EPSS
- <1% chance of exploitation in the next 30 days · higher than 18% of all CVEs
- Fix
- gpustack (pip) fixed in 2.2.2
- Weakness
- CWE-294, CWE-347
Timeline
GitHub Advisory Database published advisory GHSA-62m9-f875-rqw6 disclosing the vulnerability
GitHub Advisory Database
GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover (CVE-2026-102894)
Source
GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover (CVE-2026-102894) ↗ GitHub Advisory Database · 2h ago
First seen · 1 source · Full story page · How tiers are decided