# GPUStack: an authentication bypass exposes AI infrastructure Canonical: https://www.oktsec.com/radar/gpustack-cve-2026-102895 Publisher: Oktsec Language: en Published: 2026-11-11T13:37:53Z Updated: 2026-11-11T13:37:53Z Record reviewed: 2026-11-11T13:37:53Z Latest evidence check: 2026-11-11T13:37:53Z Disclosed: 2026-07-31 GPUStack reports exploitation against a 2.1.1 deployment. A default trust in requests seen as local can grant administrative access and expose worker credentials or enable code execution. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: The maintainer reports exploitation and CISA added the CVE on November 9. Default trust in loopback traffic creates an administrative path when external requests appear local. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: GPUStack - Products: GPUStack - CVEs: CVE-2026-102895 ## Technical overview The vulnerable default grants administrator privileges to requests considered local. A proxy on the same machine or a forged real-IP header can expose this path remotely. Version 2.2.0 removes that implicit trust. The maintainer documents exploitation on version 2.1.1. CISA added the CVE to KEV on November 9; the advisory was originally published in July. This is newly prioritized coverage, not a claim that the flaw was discovered today. Oktsec recommends treating software correction and recovery as separate tasks: administrative keys or worker changes made before patching may survive an upgrade. ## Recommended response Upgrade GPUStack to 2.2.0 or later and restrict API access. Review unexpected administrator keys, custom backends and workers; revoke credentials affected by unauthorized access. Relevant to: Teams running GPUStack, especially deployments behind a reverse proxy on the same host. ## CVE attribution - CVE-2026-102895: GPUStack — GPUStack. [Source](https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr) ## Affected systems and fixes ### GPUStack Affected: Before 2.2.0; the documented path uses force_auth_localhost=False and requests treated as loopback. Fixed release / action: 2.2.0 or later Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.10 Checked: 2026-11-11T13:38:13.699Z ### [CVE-2026-102895](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102895) - Added: 2026-11-09 - Ransomware use: Not confirmed by CISA - Federal due date: 2026-11-12 - Federal forensic triage: Yes Action specified by CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-11T13:38:14.304Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-102895](https://api.first.org/data/v1/epss?cve=CVE-2026-102895): 0.56% probability of observed exploitation in the next 30 days; percentile 46.66%; score date 2026-11-10. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-11T13:38:14.304Z. ## Response checklist 1. **Check how requests reach GPUStack** — Inspect reverse proxy placement and handling of X-GPUStack-Real-IP. Do not assume a loopback listening address isolates an API reached through a proxy. 2. **Apply the corrected release** — Upgrade to 2.2.0 or later. If delayed, apply the maintainer workaround: force_auth_localhost=true, strip client supplied real-IP headers and restrict API reachability. 3. **Review administrative activity** — Oktsec recommends preserving logs and checking new API keys, custom backends and unexpected worker processes. Revoke unauthorized keys and rotate affected secrets from a trusted environment. ## Relevance to AI environments GPUStack manages model serving infrastructure. Administrative access can reach workers, model configuration and provider credentials. ## Sources - [GPUStack: security advisory](https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr) — GPUStack; Vendor notice; checked 2026-11-11T13:37:53Z - [CISA KEV: exact CVE records](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — CISA; Government advisory; checked 2026-11-11T13:37:53Z ## Editorial record - 2026-11-11T13:37:53Z: Added affected configurations, vendor corrections and confirmed exploitation evidence. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/gpustack-cve-2026-102895) · [Build a response plan](https://www.oktsec.com/radar/gpustack-cve-2026-102895#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=gpustack-cve-2026-102895&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=gpustack-cve-2026-102895&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.