CISA Confirms Exploitation of GPUStack Authentication Bypass
Tech GuruQuick Answer
Investigate GPUStack before 2.2.0, especially proxy deployments. Upgrade to 2.2.0 or later, preserve access and worker logs, and review administrator keys, model backends and exposed secrets for unauthorized changes.
Confirm Scope And Apply The Supported Remediation
What to do now: Record GPUStack and worker versions, proxy topology, authentication settings, API exposure, administrator keys and service owners. GPUStack before 2.2.0. The default force_auth_localhost=false permits implicit administrator access when a request is treated as loopback, including through a same-host proxy or a client-controlled real-IP header. Upgrade to 2.2.0 or later. Pending upgrade, the project recommends force_auth_localhost=true, removing client-supplied X-GPUStack-Real-IP at the edge, trusted gateway handling and keeping the API off untrusted networks. Verify unauthenticated access is rejected through every supported proxy path. Review persistent administrator keys and custom backends, worker processes and secret access; retain logs before rotating potentially exposed credentials.
Last verified: 2026-11-09 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | GPUStack API and worker infrastructure |
|---|---|
| Advisory | GHSA-gj9m-f8ph-pmhr |
| CVE | CVE-2026-102895 |
| CISA KEV addition and catalog release | November 9, 2026 (KEV addition); catalog released at 2026-11-09T16:16:16.4275Z. |
| Authority revision date | Original project advisory: 2026-07-31T11:58:14Z. Latest project revision: 2026-09-29T20:39:56Z. The new material development is CISA KEV inclusion. |
| Affected versions | GPUStack before 2.2.0. The default force_auth_localhost=false permits implicit administrator access when a request is treated as loopback, including through a same-host proxy or a client-controlled real-IP header. |
| Fixed version | GPUStack 2.2.0 or later |
| CVSS base score | 9.8 (CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | CISA confirms exploitation through the November 9, 2026 KEV addition; the project also reports in-the-wild exploitation.; no exploitation claim is inferred. |
What Changed
CISA added this GPUStack authentication bypass to KEV on November 9. The project confirms observed exploitation and describes administrative API-key creation, secret disclosure and worker code execution. The supported fix removes implicit loopback administrator access.
What To Validate Now
- Inventory. Record GPUStack and worker versions, proxy topology, authentication settings, API exposure, administrator keys and service owners.
- Establish applicability. GPUStack before 2.2.0. The default force_auth_localhost=false permits implicit administrator access when a request is treated as loopback, including through a same-host proxy or a client-controlled real-IP header.
- Remediate. Upgrade to 2.2.0 or later. Pending upgrade, the project recommends force_auth_localhost=true, removing client-supplied X-GPUStack-Real-IP at the edge, trusted gateway handling and keeping the API off untrusted networks.
- Validate. Verify unauthenticated access is rejected through every supported proxy path. Review persistent administrator keys and custom backends, worker processes and secret access; retain logs before rotating potentially exposed credentials.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
A fixed version does not remove attacker-created keys or reverse-shell backends. Coordinate investigation and credential rotation with incident responders, preserve evidence, and test trusted gateway configuration. CISA lists November 12, 2026 as the due date and flags forensic triage. Federal readers should validate applicable directive requirements; other organizations should use their own incident and change procedures. Ransomware campaign use is listed as Unknown.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
