Security · High impactFan score 48 · Tier B3 sources

Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)

The Brief · written from 3 sources

GPUStack versions before v2.2.0 let any request whose source counts as loopback be promoted to the built-in administrator account when forceauthlocalhost is False, which is the default.
The loopback source can be a reverse-proxy TCP peer or an X-GPUStack-Real-IP header, so an attacker can gain unauthenticated admin access.
CISA added the flaw to its Known Exploited Vulnerabilities catalog on Monday, citing evidence of active exploitation.

Why it matters

Anyone running GPUStack behind a reverse proxy with default settings may have an admin backdoor reachable without credentials, and CISA reports it is being exploited.

Who’s affected

GPUStack operators running versions before v2.2.0

What to do

Upgrade GPUStack to v2.2.0 or later

GPUStack 2.2.0
CVE-2026-102895
#security
#authentication
#gpustack
#vulnerability
#cve-2026-102895

CVE-2026-102895 is a trivial authentication-bypass vulnerability. GPUStack is also an attractive target. It is open-source software that manages clusters of GPUs, which are typically used to run AI workloads. All versions of GPUStack prior to 2.2.0, which was released at the end…

Read the full story at isc.sans.edu ↗