Skip to content
CVE-2026-102895 in GPUStack Allows Unauthenticated Admin Access

CVE-2026-102895 in GPUStack Allows Unauthenticated Admin Access

First seen 9 Nov 2026, 22:39 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 9, 2026 at 22:40 UTC
  • •CVE-2026-102895 allows unauthenticated admin access in GPUStack versions < 2.2.0.
  • •Exploitation can occur via reverse proxy or forged headers, leading to severe impacts.
  • •The vulnerability is actively exploited, with CISA adding it to the KEV list on November 9, 2026.

A vulnerability, CVE-2026-102895, has been identified in GPUStack versions prior to 2.2.0, allowing unauthenticated administrative access. The flaw stems from the get_current_user function in gpustack/api/auth.py, which incorrectly treats loopback requests as originating from the built-in administrator account. Attackers can exploit this vulnerability via a same-host reverse proxy or by forging the X-GPUStack-Real-IP header, enabling them to modify users, models, and configurations, and execute code remotely. This vulnerability has been in the wild against version 2.1.1, leading to unauthorized administrative control and potential exposure of sensitive secrets. The issue was published on November 4, 2026, and has been added to the CISA KEV list due to. Organizations using internet-accessible GPU cluster management interfaces are particularly at risk and are urged to upgrade to version 2.2.0 immediately.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 17h ago How this analysis works

Timeline

2026-11-04
CVE-2026-102895 published
The critical vulnerability in GPUStack was disclosed, affecting versions prior to 2.2.0.
Redpacketsecurity
2026-11-09
CISA adds CVE-2026-102895 to KEV list
CISA confirmed active exploitation of the vulnerability, prompting urgent advisories for affected organizations.
Redpacketsecurity

More articles in this cluster (4)

Following this threat?

Track CVE-2026-102895 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 3

Common questions

Which versions of GPUStack are affected?
GPUStack versions prior to 2.2.0 are affected by CVE-2026-102895.
How is this vulnerability being exploited?
Attackers exploit the vulnerability by sending requests that are treated as loopback, allowing them to gain administrative access without authentication.
What should organizations do to protect themselves?
Organizations should upgrade to GPUStack version 2.2.0 immediately and restrict management access to trusted networks until patched.