CVE-2026-102895 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-11-04

Added to CISA KEV: 2026-11-09 5 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Upgrade to GPUStack v2.2.0 immediately — this is an actively exploited critical authentication bypass with confirmed in-the-wild exploitation
IMMEDIATE: Check all GPUStack instances for indicators of compromise — review API access logs for requests containing X-GPUStack-Real-IP: 127.0.0.1 headers, unauthorized API key creation events, calls to POST /v2/inference-backends/from-yaml from unauthenticated sources, and unexpected model or user changes
IMMEDIATE: If immediate upgrade is not possible, set force_auth_localhost=true in GPUStack configuration as a temporary mitigation to enforce authentication for all requests including loopback-sourced ones
URGENT: Audit all administrator API keys currently configured — attacker exploitation may have included persistent admin API key creation; revoke and rotate all existing API keys
URGENT: Restrict network access to GPUStack API ports using firewall rules, security groups, or network ACLs — GPUStack should not be directly internet-facing; place behind VPN or authenticated reverse proxy
HIGH: Audit cloud provider credentials and worker secrets stored in GPUStack — these may have been exfiltrated during exploitation; rotate any potentially exposed credentials
HIGH: Review inference backend configurations for unauthorized YAML-defined backends that could represent persistent code execution implants
MONITOR: Implement alerts for unusual GPU resource consumption patterns, as compromised GPUStack instances are likely targets for cryptomining or unauthorized AI workload execution
Patch priority: CRITICAL — patch immediately, do not wait for scheduled maintenance windows

🔍 Web Intelligence (Kagi · 2026-11-09)

Summary

CVE-2026-102895 is a critical improper authentication vulnerability affecting GPUStack, an open-source GPU cluster manager used for AI model serving and instance provisioning. The vulnerability exists within the application's authentication helper, where requests originating from or appearing to originate from a loopback address (127.0.0.1) are incorrectly granted built-in administrator privileges when the `force_auth_localhost` configuration flag is set to its default value of `false`. This flaw is significant because it allows unauthenticated remote attackers to bypass security controls and gain full administrative control over the GPU cluster manager.

Exploitation

Active Exploitation: Active exploitation of this vulnerability has been observed in the wild ^[1]^[2].
Threat Actors/Campaigns: While exploitation is confirmed, specific threat actor names or ransomware campaigns associated with this CVE are not publicly detailed at this time.
PoC/Exploit Availability: Public technical analysis indicates that the vulnerability can be exploited by spoofing a loopback connection via a same-host reverse proxy or by injecting a loopback value into the `X-GPUStack-Real-IP` header ^[4]^[6].
Attack Prerequisites: This is a remote, unauthenticated vulnerability. No user interaction is required, and the attack can be performed over the network if the instance is reachable ^[3].

Affected Products & Patches

Affected Versions: GPUStack versions prior to 2.2.0 are vulnerable ^[1].
Patch Availability: The issue has been addressed in GPUStack version 2.2.0 ^[1].
Mitigations/Workarounds: Users who cannot immediately upgrade should ensure that the `force_auth_localhost` configuration flag is set to `true`, which forces authentication for all requests, including those from the local host.

Impact

Access/Capability: Successful exploitation grants an attacker full administrative access to the GPUStack instance, allowing them to manage AI models, provision GPU instances, and potentially execute arbitrary code or commands on the underlying infrastructure ^[2]^[5].
Business Risk: For internet-facing deployments, this vulnerability poses a severe risk, as it allows remote attackers to take complete control of GPU resources, potentially leading to unauthorized usage of expensive compute power, theft of sensitive AI models, or the use of the infrastructure as a pivot point for further network compromise.

Sources

CVE-2026-102895
Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0. References. https://github.com/gpustack/ ... GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/aut…
GPUStack Auth Bypass RCE, Exploited in the Wild (CVE-2026-102895)
2026-11-04: CVE-2026-102895 is published, including the report of in-the-wild exploitation. Figure 1: The fix and the 2.2.0 release came months before the CVE record, so the upgrade window was open long before the record appeared. Source: GPUStack commits, releases and advisory, checked November 5,…
CVE-2026-102895: gpustack · Improper Authentication
CVE-2026-102895 is a critical improper authentication vulnerability in GPUStack versions prior to 2.2.0. The flaw allowed remote attackers ...
CVE-2026-102895 - Vulnerability Details - OpenCVE
The flaw resides in the authentication helper that mistakenly treats any loopback traffic as a built‑in administrator when the configuration flag force_auth_localhost is set to its default false value. By sending a request that appears to originate from 127.0.0.1—either through a same‑host reverse‑p…
CVE-2026-102895 | Vulnerability Details
GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin.

🔴 CVE-2026-102895