GPUStack Admin Bypass CVE-2026-102895 Is Exploited, and Patching Will Not Remove the Attacker

Anyone who can send an HTTP request to a GPUStack server that looks like it came from 127.0.0.1 gets the built-in administrator account, with no password. CISA added the flaw, CVE-2026-102895, to its Known Exploited Vulnerabilities catalog on November 9, 2026 and set a federal due date of November 12. GPUStack 2.2.0 contains the fix, and the Cloud Security Alliance recommends 2.2.2.

The catalog entry says the bug allows "persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml". Upgrading does not undo any of that. Admin API keys created during an intrusion survive the patch, so review and revoke them.

How the loopback check fails

The Cloud Security Alliance's research note, dated November 10, places the flaw in get_current_user in gpustack/api/auth.py. When a request carries no credentials and its apparent source address is loopback, the function loads the built-in administrator. The setting that would stop this, force_auth_localhost, defaults to false, so a default install is exposed.

There are two ways to look like loopback. A reverse proxy on the same host makes every client appear to come from 127.0.0.1. Or the client sends an X-GPUStack-Real-IP header. The advisory and NVD describe the header path as general; the note says Ostorlab found it is honoured only in embedded gateway mode, and tells defenders to assume the broader reading. The CVE Numbering Authority, GitHub, scores the flaw CVSS 3.1 9.8.

The score is fair here. The precondition is network reachability to the API, and that is exactly what a shared inference cluster offers its users.

What attackers did with it

NVD records exploitation in the wild against a GPUStack 2.1.1 deployment. According to the note, the attackers reached the admin context, registered custom inference backends through the from-yaml endpoint and used them to start reverse shells on worker hosts. The same note says public reporting contains no victim counts, no date of first exploitation and no indicators of compromise, and that reports disagree on whether a public proof of concept exists.

Date	Event (per Cloud Security Alliance)
May 19, 2026	Fix commit lands
June 18, 2026	GPUStack 2.2.0 released
July 31, 2026	GHSA-gj9m-f8ph-pmhr published
Nov. 4, 2026	CVE-2026-102895 published to NVD
Nov. 9, 2026	Added to CISA KEV
Nov. 12, 2026	CISA due date

The table shows a gap of 101 days between the advisory and the KEV listing, with 2.2.0 already out for 144 days when CISA acted. Anyone running a version before 2.2.0 had a published fix for most of that stretch.

What to do

The CSA note lists these steps: upgrade to 2.2.0 or later, preferably 2.2.2, which also fixes CVE-2026-102894 (CVSS 9.1, a SAML authentication bypass), and recreate containers so the new image takes effect. If you cannot upgrade, set force_auth_localhost=true, strip client-supplied X-GPUStack-Real-IP headers at the edge and take the API off untrusted networks.

Then assume the worst about what the server held. Review users and API keys (especially keys scoped *), registered inference backends, proxy logs and worker process trees. Rotate every worker token and cloud-provider credential GPUStack could read, and audit those cloud accounts.

GPUStack schedules model workloads across worker machines, which is why the admin context reaches worker hosts and cloud credentials. For another self-hosted inference setup, see NVIDIA's two-DGX-Station vLLM run of GLM-5.3. The same CISA batch also included FreeSWITCH's SIP MESSAGE command injection.