GPUStack Auth Bypass Gave Attackers Admin Access With No Login

GPUStack is an open source GPU cluster manager. It serves AI models and provisions GPU instances. A flaw in its login check gave remote attackers admin access. No login was needed. Attacks were already seen in the wild.

The flaw

The record is CVE-2026-102895. Common Vulnerabilities and Exposures (CVE) is the public record system for flaws. GitHub, Inc. is the CNA for this record. CNA means CVE Numbering Authority. The score is 9.8 on the Common Vulnerability Scoring System (CVSS) version 3.1. That score comes from GitHub as CNA. The National Vulnerability Database (NVD) has not yet provided its own score. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. All builds before 2.2.0 are affected. Version 2.2.0 fixed the flaw.

The code sits in gpustack/api/auth.py. A function named get_current_user checked the request source. It treated a loopback request as the built in administrator. That happened when force_auth_localhost was false. False was the default setting. A remote request could look like it came from 127.0.0.1. The client_ip_getter code accepted a same host reverse proxy peer. It also accepted a client supplied X-GPUStack-Real-IP loopback value. Either path fooled the check. The weakness types are CWE-287, CWE-290, and CWE-346. CWE means Common Weakness Enumeration.

What attackers could do

Admin access opened the whole system. Attackers could change users and models. They could create a lasting admin API key. They could read worker secrets and cloud provider secrets. They could run code through POST /v2/inference-backends/from-yaml. That endpoint builds an inference backend from YAML input. YAML means Yet Another Markup Language, a plain text data format.

SecurityOnline reported on November 5, 2026 that researcher Javier Sixto of ulex.fr reported active attacks. Intruders used custom backends for reverse shells on worker hosts. A reverse shell gives an attacker a command line on the host. That turns a login flaw into full host control.

The NVD description states the key fact in plain words. It says, "Exploitation was observed in the wild against a 2.1.1 deployment". That sentence matters. It means patching is not a drill. It is a response to live attacks.

A second flaw in the same update path

A sibling flaw needs the same attention. The record is CVE-2026-102894. It scores 9.1. Its SAML callback trusted an unverified SAMLResponse. Security Assertion Markup Language (SAML) is a login standard for single sign on. The flaw allowed auth bypass and account takeover. Version 2.2.2 fixed it. Teams should update to 2.2.2 or later. That one update fixes both flaws.

What to do now

First, list every GPUStack deployment. Record the version on each one. Second, update each deployment to 2.2.2 or later. Third, test the fix on the live system. Send a remote request with no login. Confirm it no longer gains admin access. A ticket that says patched is not proof. A test on the live system is proof.

Fourth, hunt for signs of past access. Look for new admin users. Look for new API keys. Look for new inference backends. Look for odd processes on worker hosts. Fifth, rotate secrets that an attacker could have read. That includes worker secrets and cloud provider secrets. Rotate them even if the hunt finds nothing. A quiet break in leaves no log line to find.

This flaw has no listing in the Known Exploited Vulnerabilities (KEV) catalog in the sources checked for this story. KEV is run by the Cybersecurity and Infrastructure Security Agency (CISA). The lack of a KEV listing does not lower the risk. Live exploitation is already confirmed in the NVD record.

The governance lesson

The flaw came from a default. A local trust shortcut was left on. It treated a network claim as proof of identity. That is the lesson for every team. A default that grants admin access must be checked. Evidence must prove the fix works. A version number alone does not prove it. A dated test does.

Sources

• CVE-2026-102895 record, CVE Program. Auth bypass in GPUStack, fixed in 2.2.0.
• National Vulnerability Database (NVD) record for CVE-2026-102895. Score 9.8 from GitHub as CNA. Exploitation observed in the wild against a 2.1.1 deployment.
• GitHub security advisory GHSA-gj9m-f8ph-pmhr. https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr
• GPUStack release 2.2.0. https://github.com/gpustack/gpustack/releases/tag/v2.2.0
• CVE-2026-102894 record, CVE Program. SAML callback flaw, fixed in 2.2.2.
• SecurityOnline coverage, November 5, 2026. It reports active attacks found by researcher Javier Sixto of ulex.fr. Intruders used custom backends for reverse shells on worker hosts.
• Original diagram by PolicyCortex.

Next step

Update every GPUStack deployment to 2.2.2 or later. Then test the admin path and file the dated proof.