GPUStack authentication bypass before 2.2.0 gives unauthenticated admin access (CVE-2026-102895)

What happened

GPUStack's API treated a request whose source appeared to be 127.0.0.1 as the built-in administrator when force_auth_localhost was false, which was the default. Because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP header set to a loopback value, a remote request could appear local and gain unauthenticated administrative access. The CVE record rates this critical at CVSS 3.1 9.8: network reachable, low attack complexity, no privileges or user interaction, high impact on confidentiality, integrity and availability.

With that access, an attacker could change users and models, create persistent administrator API keys, read worker and cloud-provider secrets, and execute code through POST /v2/inference-backends/from-yaml.

CISA added CVE-2026-102895 to KEV on 2026-11-09 with a due date of 2026-11-12. CISA SSVC marks exploitation active, ENISA EUVD records exploitation since 2026-11-09, and the CVE record notes exploitation observed in the wild against a 2.1.1 deployment.

Who is affected

Affected versions are all GPUStack releases before 2.2.0. GPUStack is an open-source cluster manager for AI model serving and GPU instance provisioning, so affected deployments are typically the management plane for GPU infrastructure. If your GPUStack instance is reachable from anything other than localhost, treat it as affected until upgraded. The fixed release is 2.2.0.

What to do now

1. Upgrade to GPUStack 2.2.0. The fixed version listed is gpustack 2.2.0; no workaround is listed for earlier releases.
2. Until the upgrade is complete, restrict network access to GPUStack so only trusted hosts can reach it. The flaw is exploitable from the network with no credentials, so reduce internet exposure immediately.
3. Treat any instance that was reachable as potentially compromised. Review administrator API keys, user and model changes, and inference backend definitions for anything you did not authorise; the bypass allowed persistent administrator API-key creation and code execution.
4. Follow CISA's KEV due date of 2026-11-12 and required action, including BOD 26-04 patching guidance and forensics triage requirements. For cloud services, CISA directs discontinuing use if mitigations are unavailable.

How to detect it

Start with administrator API keys and changes to users, models, or inference backends. The bypass allowed persistent administrator API-key creation and code execution through POST /v2/inference-backends/from-yaml, so unexpected API keys or backend definitions are the most direct signs that an exposed instance was used. CISA's KEV required action also directs stakeholders to its forensics triage requirements for exploited systems.

Beyond the patch

Beyond patching, this is an exploited, network-accessible flaw with code execution: you need to know whether an exposed GPUStack instance was already used, and you need to find any other internet-exposed management interfaces before the next advisory. Managed Detection & Response can hunt for the post-exploitation activity this access enabled, and Virtual CISO Services can help map and reduce internet exposure of GPU cluster management planes.