Database/Control plane, storage & DevOps

GPUStack: forged loopback source grants unauthenticated administrator access and code execution

CVSS 9.8CVE-2026-102895Control plane, storage & DevOpsKnown exploitedcurated

Impact

Before 2.2.0, GPUStack treats any request that looks like it comes from 127.0.0.1 as the built-in administrator when force_auth_localhost is false, which is the default. A remote attacker can fake that origin with a client-supplied X-GPUStack-Real-IP loopback value, or by coming through a reverse proxy on the same host. That gives full admin over the cluster manager: they can change users and models, create persistent admin API keys, read worker and cloud-provider secrets, and run code through POST /v2/inference-backends/from-yaml. The project reports exploitation in the wild against a 2.1.1 deployment, and CISA lists this CVE as known exploited. GPUStack provisions GPU instances and model serving across the fleet, so the leaked worker and cloud credentials reach well beyond the manager host.

Who can reach it

Anyone who can reach the GPUStack server's HTTP API over the network. No authentication is needed. Deployments behind a same-host reverse proxy are exposed even if the client cannot set the header.

What to do

Upgrade GPUStack to 2.2.0 and restart the server. Exploitation has been observed, so treat 2.1.x and earlier instances that were reachable as possibly compromised. Revoke administrator API keys you do not recognise, rotate the worker and cloud-provider secrets GPUStack held, and review the inference backends and models it has configured. Until you can upgrade, keep the API off untrusted networks. Per the description, the bypass only applies when force_auth_localhost is false.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-102895 https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr https://github.com/gpustack/gpustack/releases/tag/v2.2.0 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102895

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.