GPUStack: cluster API proxy forwards non-admin requests with a worker's ServiceAccount credentials

Impact

In GPUStack 2.2.0 through 2.2.1 the cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster with no resource-level authorization check, using the credentials of a reachable worker's Kubernetes ServiceAccount. Any logged-in GPUStack user therefore acts with that ServiceAccount's full rights: reading secrets and other sensitive resources, creating or modifying workloads, or deleting them. Because the attacker can create workloads, this becomes code execution inside the target cluster - on a GPU cluster manager that means a low-privileged user can schedule their own pods onto GPU nodes and reach other tenants' model-serving workloads. Requires a Kubernetes-provider cluster with a reachable worker.

Who can reach it

Any authenticated GPUStack user who is not an administrator, over the GPUStack API, against a Kubernetes-provider cluster that has a reachable worker.

What to do

Upgrade GPUStack to 2.2.2 or later and restart the GPUStack server. No node reboot. Afterwards, rotate the worker ServiceAccount tokens that the proxy was using and audit the target clusters for workloads created by unexpected principals; tightening the ServiceAccount's RBAC limits the blast radius of any similar gap.

References

Related entries

• Apache Airflow: task-written XCom makes the API server instantiate attacker-chosen airflow.* classesCVE-2026-111421 · Apache Airflow API server (Task Execution API XCom storage and deserialization)High
• Airflow SSH provider: command injection through templated environment values in SSHRemoteJobOperatorCVE-2026-111422 · Apache Airflow SSH provider (SSHRemoteJobOperator templated environment)High
• Atlantis: shell metacharacters in a pull request workspace name run commands as the Atlantis service accountCVE-2026-116676 · Atlantis (Terraform PR automation server, workspace name handling)High
• Jenkins: XStream deserialization filter not applied to resolves-to classesCVE-2026-117612 · Jenkins controller (XStream deserialization filter, resolves-to attribute)High
• Jenkins: unvalidated agent name lets a read-only user load and overwrite arbitrary config.xml on the controllerCVE-2026-117616 · Jenkins controller (agent-by-name HTTP endpoint)High
• Jenkins: low-privilege user can seed Manage Old Data warnings that overwrite user accounts including passwordsCVE-2026-117620 · Jenkins controller ("Manage Old Data" migration feature)High