CVE-2026-102895

Received Received - Intake

Authentication Bypass in GPUStack via Loopback IP Spoofing

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-102895

EUVD

EUVD-2026-117124

Affected Vendors & Products

Vendor	Product	Version / Range
gpustack	gpustack	< 2.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-346	The product does not properly verify that the source of data or communication is valid.
CWE-290	This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

GPUStack before 2.2.0 had an authentication bypass where requests from remote sources could be treated as coming from localhost (127.0.0.1). This happened because the system incorrectly trusted client-supplied headers like X-GPUStack-Real-IP or reverse proxy peer addresses. As a result, unauthenticated users could gain administrative access to the system.

Detection Guidance

Check GPUStack version with 'gpustack --version' or inspect API logs for unauthorized administrative actions like user/model changes or secret disclosures. Monitor for POST requests to /v2/inference-backends/from-yaml from non-localhost sources.

Impact Analysis

This vulnerability allows remote attackers to perform unauthorized administrative actions such as creating persistent admin API keys, modifying users and models, accessing sensitive secrets, and executing arbitrary code via specific API endpoints. Exploitation has been observed in real-world attacks against vulnerable versions.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating confidentiality requirements in GDPR and HIPAA. Unauthorized administrative access may result in exposure of sensitive data, non-compliance with data protection controls, and potential legal penalties due to inadequate security measures.

Mitigation Strategies

Upgrade GPUStack to version 2.2.0 or later immediately. If upgrading is not possible, set force_auth_localhost to true in the configuration to enforce local authentication. Block external access to localhost-bound APIs and review logs for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-102895. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...