Security · High impactFan score 47 · Tier B2 sources
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
The Hacker News ·
The Brief · written from 2 sources
- GPUStack versions before v2.2.0 let any request whose source counts as loopback be promoted to the built-in administrator account when forceauthlocalhost is False, which is the default.
- The loopback source can be a reverse-proxy TCP peer or an X-GPUStack-Real-IP header, so an attacker can gain unauthenticated admin access.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog on Monday, citing evidence of active exploitation.
Why it matters
Anyone running GPUStack behind a reverse proxy with default settings may have an admin backdoor reachable without credentials, and CISA reports it is being exploited.
Who’s affected
- GPUStack operators running versions before v2.2.0
What to do
- Upgrade GPUStack to v2.2.0 or later
- GPUStack 2.2.0
- CVE-2026-102895
- #security
- #authentication
- #gpustack
- #vulnerability
- #cve-2026-102895
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The…
Timeline
Authentication bypass disclosed in GitHub Advisory Database (GHSA-gj9m-f8ph-pmhr)
CISA adds GPUStack flaw to Known Exploited Vulnerabilities catalog
GitHub Advisory Database
GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin (CVE-2026-102895)
The Hacker News
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
Full coverage · 2 sources
- 1h ago ↗
The Hacker News
CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
- 10h ago ↗
GitHub Advisory Database
GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin (CVE-2026-102895)