GPUStack's 9.8 Loopback Bypass Hits CISA's KEV List 101 Days After Its Advisory

An unauthenticated attacker who can reach a GPUStack server before version 2.2.0 can become its built-in administrator, create a persistent admin API key, read worker and cloud-provider secrets, and run code on the GPU hosts (CVE-2026-102895, CVSS 9.8). CISA added it to the Known Exploited Vulnerabilities catalog on November 9 with a due date of November 12, and flagged it for forensic triage.

GPUStack is an open-source GPU cluster manager for AI model serving. The fix is 2.2.0, and the workaround for anyone who cannot upgrade is to set force_auth_localhost=true, strip the X-GPUStack-Real-IP header at the edge and keep the API off untrusted networks.

How a request becomes the administrator

The GitHub advisory GHSA-gj9m-f8ph-pmhr says get_current_user "promotes any request whose source is considered loopback to the built-in administrator account" when force_auth_localhost is false, which is the default. There are two ways to look like loopback:

• A reverse proxy on the same host. Every remote request reaches GPUStack from 127.0.0.1, so no header or credential is needed.
• A forged header. A client sends X-GPUStack-Real-IP: 127.0.0.1 and the server believes it.

The NVD record names the vulnerable function (get_current_user in gpustack/api/auth.py) and the code-execution route, POST /v2/inference-backends/from-yaml. The vector is AV:N/AC:L/PR:N/UI:N, so the 9.8 reflects what it says: no access, no complexity, no user interaction. Nothing in the score is inflated, and exposure depends on one thing, whether the management port is reachable.

What is known about exploitation

Both the advisory and the NVD record say the flaw "has been observed exploited in the wild" against a 2.1.1 deployment. The advisory credits that report to Javier Sixto (ulex.fr). It does not say what the attackers did after gaining access, how many servers were affected or when the activity began. CISA's NVD enrichment rates exploitation as active and the flaw as automatable.

Independent discovery is also credited: Nikko Enggaliano, Wei Yunzhou, and Rui Yang and Haoyu Wang of Johns Hopkins University reported it separately.

A 101-day gap between advisory and KEV

Date	Event
July 31, 2026	GHSA-gj9m-f8ph-pmhr published by maintainer gitlawr
November 4	CVE record and NVD entry published
November 9	CISA adds the CVE to KEV; due November 12

The advisory has been public for 101 days. The 2.2.0 release page shows a publication date of June 18 (the page carries no year) and its notes do not mention loopback authentication at all; they list SSO, API-key and TLS fixes. The advisory page says the fix "removed the loopback auto-admin path and hardened client-IP and forwarding-header handling," so the release notes understate what changed for anyone deciding whether to upgrade.

Eight other advisories on the same page

The advisories page lists ten entries on its first screen, eight published on October 26 alone. Only the loopback bypass is in the KEV catalog.

Advisory	Severity	Published
Authentication bypass via trusted loopback source	Critical	Jul 31
Missing authorization in Kubernetes API proxy	High	Oct 1
Cluster proxy authorizes paths before dot-segment normalization	High	Oct 26
World-readable JWT secret key allows local admin JWT forgery	High	Oct 26
Cross-cluster worker registration, missing cluster authorization	High	Oct 26

The page shows no CVE numbers or version ranges for the October entries, so read each advisory before assuming 2.2.0 covers it.

What to do

Upgrade to 2.2.0 or later and rotate everything the server held: worker tokens, cloud-provider credentials and any API key created since the server was first exposed. Check for administrator API keys nobody remembers creating, since the attack makes persistent ones. If the instance was reachable from the internet while on 2.1.1 or earlier, treat the GPU hosts as compromised until logs say otherwise. Context on the site's earlier KEV coverage is in our report on CISA's Apple listing, and on how model-serving stacks are being probed, OpenAI's GPT-6 Cyber and the ExploitGym results.