GPUStack CVE-2026-102895: critical auth bypass exploited

What it is and who is affectedCVE-2026-102895 is an improper authentication vulnerability in GPUStack, the open-source GPU cluster manager used to ser...

What it is and who is affected

CVE-2026-102895 is an improper authentication vulnerability in GPUStack, the open-source GPU cluster manager used to serve AI models and provision GPU instances. The flaw is tracked by the NIST National Vulnerability Database, which published it on 4 November 2026, and it carries a CVSS 3.1 score of 9.8 (critical).

According to the NVD, every GPUStack release prior to 2.2.0 is affected. The root cause sits in the get_current_user function of gpustack/api/auth.py: when force_auth_localhost was left at its default value of false, a request appearing to come from loopback was treated as the built-in administrator. A remote attacker could make a request look like it originated from 127.0.0.1, either through a same-host reverse proxy peer or by supplying a loopback value in the X-GPUStack-Real-IP header. The weakness maps to CWE-287, CWE-290 and CWE-346.

The consequences are serious for any organisation running AI infrastructure. An unauthenticated attacker could obtain administrative access, change users and models, create persistent administrator API keys, expose worker and cloud-provider secrets, and execute code through the POST /v2/inference-backends/from-yaml endpoint. If your team runs GPUStack on its own servers, or your managed hosting provider does, this is directly relevant.

Why it is urgent

This is not a theoretical risk. The NVD notes that exploitation was observed in the wild against a 2.1.1 deployment, and CISA added CVE-2026-102895 to its Known Exploited Vulnerabilities (KEV) catalogue on 9 November 2026. That means real attacks are already happening against unpatched instances.

CISA has given US federal agencies until 12 November 2026 to apply mitigations following the vendor's instructions, in line with its BOD 26-04 guidance on prioritising security updates by risk, and to follow its forensics triage requirements. The agency also asks asset owners to assess each system's internet exposure. Even if you are a Spanish SME outside US federal scope, the KEV listing is the clearest possible signal: attackers are actively looking for this. There is no record of ransomware use in this campaign, but the level of access the flaw grants makes it a valuable foothold regardless.

What to do today

Check whether you run GPUStack and on which version. Anything below 2.2.0 is exposed. Confirm the exact build rather than assuming an update was applied.
Upgrade to 2.2.0, where the issue is fixed. The vendor advisory GHSA-gj9m-f8ph-pmhr and the release notes for v2.2.0 set out the details; apply whatever the vendor advisory specifies if you cannot upgrade immediately.
Look for signs of intrusion. Review administrator API keys you did not create, unexpected changes to users or models, and any unusual calls to the inference-backends endpoint. Rotate worker and cloud-provider credentials that may have been exposed.
Reduce internet exposure. Restrict access to the GPUStack interface and API to trusted networks or a VPN, and be wary of reverse proxy setups that could mask the true origin of requests.

Because the bypass relies on how the application interprets request origin, simply putting it behind a proxy is not a fix on its own. Treat the version upgrade as the priority and the network controls as defence in depth.

How a cybersecurity team can help

For a small business or e-commerce operation with a compact IT team, keeping track of advisories like this one across every server, CMS and internal tool is a full-time job. This is where a specialist team such as ALMC's fits in: we audit the estate to find exposed services and unpatched software before attackers do, run penetration tests to validate what is really reachable from outside, and harden servers so a single misconfiguration does not become an open door.

We also monitor for suspicious activity and respond to incidents, including repairing hacked websites on WordPress, PrestaShop and Joomla, and keeping those platforms patched as part of ongoing maintenance. For organisations running AI infrastructure or self-hosted tooling, the practical question is not whether a CVE like this will appear, but whether anyone will notice it in time. A structured patching routine, combined with GDPR-aligned controls for any personal data on those systems, turns a critical alert into a routine maintenance task instead of a breach.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.