GPUStack CVE-2026-102895: exploited auth bypass, how to fix it

TL;DR

• What: CVE-2026-102895 is an authentication bypass in GPUStack, open-source software for running AI models on a cluster of GPU machines. A request that looks like it comes from the same machine is treated as the built-in administrator.
• Impact: an unauthenticated attacker gets full administrative access, can create persistent administrator API keys, read worker and cloud-provider secrets, and run code on worker hosts.
• Severity: a CVSS v3.1 score of 9.8 (critical) from GitHub's security advisories team, weakness classes CWE-287, CWE-290 and CWE-346.
• Exploited: yes. CISA added it to its Known Exploited Vulnerabilities catalogue on November 9, 2026 with a due date of November 12, 2026.
• Fix: upgrade the gpustack package to 2.2.0 or later, then rotate any keys the server could reach.

What CVE-2026-102895 is

GPUStack is open-source software that manages clusters of GPU machines. Teams use it to serve AI models and to provision GPU instances, so a GPUStack server usually sits next to expensive hardware and holds credentials for the workers and cloud providers behind it.

The flaw is in how GPUStack decides who is calling. With the setting force_auth_localhost left off, as it is out of the box, a request whose source was loopback (127.0.0.1) was promoted to the built-in administrator account without any credentials. The problem is that the source address can be made to look like loopback from the outside. In the common self-hosted layout, GPUStack runs behind a reverse proxy on the same host that forwards traffic to a local port, so every remote request reaches GPUStack from the proxy's own loopback address. The second route is a client-supplied header named X-GPUStack-Real-IP: a forged loopback value in it was enough to be treated the same way.

The root cause is trusting the network source of a request, or a header the client controls, as proof of identity. The GitHub advisory describes the result as full unauthenticated administrative access over the network.

Why it matters now

This is being used against real servers. CISA added the flaw to the Known Exploited Vulnerabilities catalogue on November 9, 2026 and set a due date of November 12, 2026. The advisory says the bug was observed exploited against a GPUStack 2.1.1 deployment, where attackers created custom backends that ran reverse shells. CISA lists known ransomware campaign use as unknown.

What an administrator can do here is what makes it serious. The advisory and the CISA entry describe changing users and models, creating administrator API keys that stay valid from any source address, reading worker credentials and cloud-provider secrets, and running code through the inference-backends from-yaml endpoint. A persistent API key means that upgrading alone does not remove an attacker who already got in. CISA asks organisations to follow its forensics triage guidance as well as the vendor's mitigation.

It is the same pattern as the exploited Collabora CODE Server flaw we covered earlier: a collaboration or infrastructure tool that is reachable from the network, runs with broad privileges, and is rarely looked at once it works.

Am I affected?

You are affected if you run the gpustack pip package at any version before 2.2.0 and it is reachable over a network, especially behind a reverse proxy on the same host. Setting force_auth_localhost to true closes the loopback shortcut, but the default leaves it open.

To check one machine by hand, ask pip for the installed version and look at how the service is configured:

pip show gpustack
pip list | grep -i gpustack
ps aux | grep -i gpustack
grep -ri force_auth_localhost /etc /opt /home 2>/dev/null

The first two commands show the installed version. The process list shows where it runs, and the last one finds a configuration that sets force_auth_localhost. Also look at your reverse proxy configuration for a proxy_pass to a loopback address, because that is the layout the advisory describes as vulnerable. Remember container images and virtual environments: GPUStack can live inside an image or a virtualenv that a host package list will not show.

How to fix CVE-2026-102895

The fix is to move to a release that removed the loopback shortcut. Work through these steps in order:

1. List every GPUStack server and record its version with the commands above, including test, staging and image-based deployments.
2. If you cannot upgrade at once, apply the advisory's workarounds first: set force_auth_localhost to true, make sure your reverse proxy cannot make outside traffic look like loopback, remove the X-GPUStack-Real-IP header from incoming requests at the edge, and keep the API off untrusted networks behind a VPN or edge authentication.
3. Upgrade the gpustack package to 2.2.0 or later, for example with pip install --upgrade gpustack inside the environment that runs it, and restart the service.
4. Assume that a server reachable from the internet before the upgrade may have been used. Review the list of administrator API keys and delete any you do not recognise, check for custom inference backends you did not create, and look for unexpected outbound connections from worker hosts.
5. Rotate the worker credentials and cloud-provider secrets stored in GPUStack, then re-run your inventory check and confirm that no server still reports a version before 2.2.0.

Our guide to remediation in Stackurity explains how an upgrade appears as one fix with the version to move to and every issue it clears.

How to check with Stackurity

Stackurity keeps one live inventory of the software on your servers, deployed applications, repositories and container images. GPUStack is a pip library, which Stackurity finds in repositories and in the libraries that deployed applications load. That inventory is matched against new vulnerability advisories and the CISA Known Exploited Vulnerabilities catalogue every hour, and each finding is ranked from P1 to P4 with one sentence on why it applies. A catalogue entry for an exploited flaw lifts a finding to the top of the list.

After you upgrade, the check again function asks the agent for a fresh report and records whether the issue is passed, partly fixed or still open, so you can show that the fix landed. The verification guide describes that step.

Be clear about the limits. Stackurity does not assess libraries copied into an application outside a package manager or lockfile, and it does not cover network appliance firmware, so use the hand check above for anything installed that way. The core is open source under Apache-2.0, and Stackurity Cloud has a 14-day free trial without a card: start a free trial.

FAQ

Is CVE-2026-102895 being exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on November 9, 2026, and the GitHub advisory says it was seen exploited in the wild against a GPUStack 2.1.1 deployment, where attackers created custom backends that ran reverse shells.

Which GPUStack versions are affected?

Every release of the gpustack pip package before 2.2.0. The default setting, force_auth_localhost left as false, is the vulnerable one.

What is the fixed version of GPUStack?

Version 2.2.0 removed the loopback auto-admin path and hardened how the client address and forwarding headers are handled. Upgrade to 2.2.0 or later.

Can I mitigate CVE-2026-102895 without upgrading?

The advisory lists workarounds: set force_auth_localhost to true, make sure your reverse proxy cannot make external traffic look like loopback, remove the X-GPUStack-Real-IP header from incoming requests at the edge, and keep the API off untrusted networks. These reduce exposure, but the upgrade is the real fix.

How severe is CVE-2026-102895?

It has a CVSS v3.1 base score of 9.8, rated critical, from GitHub's security advisories team. The weaknesses are CWE-287, CWE-290 and CWE-346.

Does Stackurity find GPUStack?

GPUStack is a pip library, so Stackurity finds it in repositories and in the libraries that deployed applications load, then matches it against advisories and the CISA catalogue. Libraries copied into an application outside a package manager or lockfile are not covered, so confirm those by hand.

Sources: CISA Known Exploited Vulnerabilities catalogue, NIST National Vulnerability Database, GitHub Advisory Database and Stackurity product facts.