# CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws

Source: [The Hacker News](https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html) · 2026-11-10 · Security
Page: https://themorning.dev/story/cisa-warns-of-active-exploitation-of-openssh-gpustack-freeswitch-and-ibm-flaws-b579a343e6b64bab
Kind: security · Impact: high

## In brief

- GPUStack versions before v2.2.0 let any request whose source counts as loopback be promoted to the built-in administrator account when forceauthlocalhost is False, which is the default.
- The loopback source can be a reverse-proxy TCP peer or an X-GPUStack-Real-IP header, so an attacker can gain unauthenticated admin access.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog on Monday, citing evidence of active exploitation.

## Why it matters

Anyone running GPUStack behind a reverse proxy with default settings may have an admin backdoor reachable without credentials, and CISA reports it is being exploited.

## What to do

- Upgrade GPUStack to v2.2.0 or later

## Versions

- GPUStack 2.2.0

## CVEs

- CVE-2026-102895

## Timeline

- 2026-11-09: Authentication bypass disclosed in GitHub Advisory Database (GHSA-gj9m-f8ph-pmhr)
- 2026-11-09: CISA adds GPUStack flaw to Known Exploited Vulnerabilities catalog

## Coverage

- [CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws](https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html) — The Hacker News, 2026-11-10
- [GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin (CVE-2026-102895)](https://github.com/advisories/GHSA-gj9m-f8ph-pmhr) — GitHub Advisory Database, 2026-11-09

Tags: security, authentication, gpustack, vulnerability, cve-2026-102895

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev