GPUStack Auth Bypass Exploited Four Months After the Fix Shipped

An unauthenticated attacker who can send a request to a GPUStack server running any version before 2.2.0, in its default configuration, can become the administrator and run code on the GPU workers behind it. CISA added the flaw, CVE-2026-102895 (CVSS 9.8), to its Known Exploited Vulnerabilities catalog on November 9, with a federal due date of November 12.

The fix has been public since June 18. What changed this week is the evidence that someone is using the bug.

How the bypass works in GPUStack before 2.2.0

GPUStack is an open-source manager for GPU clusters that serve language models. The GitHub advisory, published July 31, says the function get_current_user grants built-in administrator access to any request treated as loopback when force_auth_localhost is false, which is the default.

Two paths make a request look like it came from 127.0.0.1. A reverse proxy on the same host makes every proxied request arrive with a loopback TCP peer. A forged X-GPUStack-Real-IP header set to loopback does the same. The advisory's own root-cause line is that the software "treats the network source of a request" as proof of identity.

CISA's entry lists what the administrator can then do: change users and models, create persistent administrator API keys, read worker and cloud-provider secrets, and execute code through POST /v2/inference-backends/from-yaml.

Timeline

Date	Event
May 19, 2026	Fix commit lands in the repository
June 18	GPUStack 2.2.0 released with the fix
July 31	GitHub advisory GHSA-gj9m-f8ph-pmhr published
November 4	CVE-2026-102895 and CVE-2026-102894 published to NVD
November 9	CISA adds CVE-2026-102895 to KEV
November 12	Federal due date

The first three rows come from a Cloud Security Alliance research note that reconstructs the timeline. The Terminal did not independently check the commit date.

The score is fair, with one caveat

The score fits the default configuration: network-reachable, no privileges, no user interaction, full confidentiality, integrity and availability impact. The caveat is the header path. The Cloud Security Alliance note says sources disagree on whether the X-GPUStack-Real-IP route works in general or only behind certain proxies. The same-host reverse proxy path needs no forged header at all.

The advisory states that exploitation was observed against a version 2.1.1 deployment. It credits Javier Sixto of ulex.fr with reporting that activity. The CSA note says attackers registered custom inference backends and launched reverse shells on workers. Neither source gives a first-exploitation date, a victim count or indicators of compromise, and the CSA note says public reporting lacks all three.

Patching does not remove an intruder

Upgrade to 2.2.0 at minimum. The CSA note recommends 2.2.2, which also fixes CVE-2026-102894, a separate SAML bypass it rates at CVSS 9.1. That second flaw is not in KEV as of this writing. Recreate containers so the new image takes effect.

Admin API keys created during an intrusion survive the fix, and the CSA note says keys with the * scope stay valid after the proxy rule is removed. After upgrading, review administrator accounts, API keys, registered inference backends and worker processes, then rotate every worker token and cloud credential GPUStack held.

If an upgrade has to wait, the advisory's workarounds are setting force_auth_localhost=true, stripping X-GPUStack-Real-IP at the proxy, and keeping the API off untrusted networks behind a VPN or an authenticating gateway.

The Terminal has covered other AI infrastructure exposures, including Wiz's report on developer platforms and the Chainstack intrusion. The CSA note puts GPUStack at about 6,000 GitHub stars and more than 940,000 Docker Hub pulls, and says neither figure measures vulnerable deployments.