GPUStack auth bypass is being exploited: CISA adds CVE-2026-102895 to KEV

GPUStack is an open-source manager for GPU clusters that serve models. On 9 November, CISA added its authentication bypass, CVE-2026-102895, to the Known Exploited Vulnerabilities catalog, with a 12 November deadline for US federal agencies. The project’s advisory rates it critical, CVSS 9.8.

The bug

Before version 2.2.0, GPUStack promoted any request that came from loopback (127.0.0.1) to the built-in administrator account. That was the default, because the force_auth_localhost setting was off.

The advisory describes two ways a remote attacker can look like loopback without any credentials:

• A same-host reverse proxy. If GPUStack sits behind nginx or similar on the same machine with proxy_pass http://127.0.0.1:<port>, every request reaches GPUStack from 127.0.0.1. That is the common self-hosted setup, and no header trick is needed.
• A forged header. Sending X-GPUStack-Real-IP: 127.0.0.1 can make the request source count as loopback.

Either way the attacker gets full admin over the network. Per the advisory, that means changing users, models, workers and configuration, reading worker credentials and cloud provider secrets, and minting admin API keys with scope * that keep working from any IP afterwards. Through the admin-only POST /v2/inference-backends/from-yaml endpoint, it leads to code execution on worker hosts.

Seen in the wild

The advisory says exploitation was observed against a v2.1.1 deployment, where attackers created custom inference backends that ran reverse shells. CISA’s entry flags the flaw for forensic triage, not only patching. How widely it has been used is not public.

The fix is not new: GPUStack 2.2.0 shipped on 18 June and removed the loopback auto-admin path, and the current line is 2.3.x. The news is that unpatched clusters are being found and used. It fits the pattern of exposed AI endpoints that Symantec and Wiz have tracked, where GPU access itself is the prize.

What to do

1. Upgrade to 2.2.0 or later.
2. If you cannot upgrade today, set force_auth_localhost=true, strip any client-supplied X-GPUStack-Real-IP header at your proxy, and keep the API off untrusted networks.
3. After upgrading, list admin API keys and revoke any you did not create. The advisory says minted keys stay valid from any source; we found no statement that the upgrade revokes them.
4. Check for custom inference backends you did not add, and rotate the worker and cloud credentials GPUStack held.

The same KEV batch also added flaws in OpenSSH, FreeSWITCH and IBM Aspera Faspex.

Why this matters

“Trust localhost” breaks the moment a reverse proxy runs on the same box, which is how many teams publish an internal tool. GPUStack fixed that in June, but a cluster nobody upgraded is now a confirmed target. If you self-host any model-serving panel, check whether it treats loopback or a forwarding header as proof of identity, and test it through your own proxy, not just on the machine.