CISA has added CVE-2026-102895 to its KEV catalog. The flaw is a critical (CVSS 9.8) improper authentication bug in GPUStack versions before 2.2.0, and attackers are already exploiting it.
What Is It
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. In versions before 2.2.0, the get_current_user function in gpustack/api/auth.py treated any request from a loopback source as the built-in administrator whenever force_auth_localhost was false. That was the default setting.
A remote request could pass as coming from 127.0.0.1 in two ways. First, client_ip_getter accepted a reverse proxy running on the same host as the peer address. Second, it accepted a client-supplied X-GPUStack-Real-IP header set to a loopback value. NVD maps the issue to CWE-287 (Improper Authentication), CWE-290 (Authentication Bypass by Spoofing) and CWE-346 (Origin Validation Error).
Why It Matters
The bypass gives an attacker unauthenticated administrative access. With it they can:
- Modify users and models
- Create persistent administrator API keys
- Read worker and cloud-provider secrets
- Execute code through
POST /v2/inference-backends/from-yaml
NVD scores it 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N). It can be reached over the network with no privileges and no user interaction.
CISA KEV confirms active exploitation. The vulnerability was added to the catalog on 2026-11-09. The NVD description says exploitation was seen in the wild against a GPUStack 2.1.1 deployment. CISA's SSVC assessment rates exploitation as "active," automatable as "yes" and technical impact as "total." KEV lists ransomware campaign use as "Unknown." KEV also flags the entry for forensic triage, so defenders should look for signs of compromise as well as patch.
What's Vulnerable
- Product: GPUStack (gpustack/gpustack)
- Affected versions: All versions before 2.2.0
- CPE:
cpe:2.3:a:gpustack:gpustack:*:*:*:*:*:*:*:*(versionEndExcluding 2.2.0) - Vulnerable condition:
force_auth_localhostset to false (the default)
Patch Status
The issue is fixed in GPUStack 2.2.0. The patch is in commit 53f42a6 and pull request #5346.
CISA requires agencies to apply mitigations according to vendor instructions, in line with BOD 26-04 and CISA's Forensics Triage Requirements. If mitigations are unavailable, they must follow the BOD 26-04 cloud-service guidance or stop using the product. The KEV due date is 2026-11-12.
Because attackers can create persistent administrator API keys and expose secrets, upgrading may not be enough. Organizations running exposed instances should also review API keys and credentials and rotate them as needed.