Events Securing Finance in the Age of AI · Secure.com X ZIG Finance · London, 12 Nov Register now
Published: November 10, 2026 5 min read

GPUStack Vulnerability: The Fix Shipped in June. The Warning Came 139 Days Later.

A GPUStack vulnerability fixed in June was flagged in November, already exploited. Upgrade before CISA's 12 November deadline.

By Secure.com
GPUStack vulnerability timeline: fix shipped 18 June, CVE published 4 November, CISA KEV listing 9 November, federal deadline 12 November
Summary

GPUStack Vulnerability Hits KEV With a Three-Day Deadline

GPUStack is a free, open-source tool for managing the GPU servers on which a company runs its own AI models. A fix for the GPUStack vulnerability CVE-2026-102895 has been available since June. The public warning only came this month, and it said attackers had already used the flaw on at least one real installation.

  • Who should care: any team that runs its own AI models on GPU servers managed with GPUStack.
  • What could go wrong: if the server is reachable from the internet behind a normal front-door server, anyone could become an administrator, read stored cloud credentials, and run their own code on the machines it manages.
  • Do this: upgrade GPUStack to the latest release (2.2.0 at minimum) now and check for admin keys you did not create. US federal agencies have until Thursday, 12 November, a pace worth copying.
  • Worth remembering (our reading): for tools your team installed itself, waiting for a vulnerability record or a scanner alert can leave you months behind the fix.

What Happened?

GPUStack 2.2.0 shipped the fix on Thursday 18 June (PyPI). The vulnerability record followed on Wednesday 4 November, 139 days later, rated 9.8 out of 10. It already stated that the GPUStack vulnerability had been exploited in the wild against a 2.1.1 deployment, where attackers created custom backends that ran reverse shells.

On Monday, 9 November, day 144, CISA put it on its Known Exploited Vulnerabilities list and gave federal agencies until Thursday, 12 November, to fix it and run forensic triage.

GPUStack vulnerability timeline: fix shipped 18 June, CVE published 4 November, CISA KEV listing 9 November, federal deadline 12 November

How the GPUStack Vulnerability Worked

Before 2.2.0, GPUStack treated any request coming from the server itself as the built-in administrator, and the setting that stopped this (force_auth_localhost) was off by default. Outsiders could look local in two ways:

  • Same machine proxy: a reverse proxy on the same host forwards their traffic from 127.0.0.1.
  • Spoofed header: they send X-GPUStack-Real-IP: 127.0.0.1, and GPUStack believes it.

Once in, they can mint lasting admin API keys, read worker and cloud provider secrets, and run code on every GPU node by registering a new inference backend.

How the GPUStack vulnerability worked: a same machine proxy or a spoofed X-GPUStack-Real-IP header gives admin access without a password

The 139 Day Blind Spot

Most patch programs start when a vulnerability record lands and a scanner check follows. For 139 days, nothing matched, so the dashboard stayed empty. GPUStack also tends to be installed with pip or Docker by the ML or platform team, not the patch team. On Docker, the fix arrives only when someone pulls the new image and recreates the container. We saw the same pattern with CVE-2026-98432, where the patch landed before the warning did.

What’s the Impact of the GPUStack Vulnerability?

A server exposed to the GPUStack vulnerability hands an attacker the whole cluster: admin access, the cloud credentials it stores, and code execution on every GPU machine it manages. Nobody has published how many servers were hit or are exposed. What is known: one real install was taken over.

How to Fix the GPUStack Vulnerability

  • Find every install. Check servers, containers, and notebooks your ML and platform teams run, not only the ones in your asset list.
  • Upgrade to the latest release. 2.2.0 closes this flaw; 2.2.2 also closes a separate critical login bypass. On Docker, pull the image and recreate the container.
  • Can’t upgrade today? Apply the advisory’s stopgaps: set force_auth_localhost to true, strip the X-GPUStack-Real-IP header at the proxy, and block outside access to /auth/saml/callback. Stripping the header alone leaves the same machine proxy path open.
  • Look for leftovers (our reading). Review admin API keys and inference backends you did not create.
  • Rotate what it held (our reading). Treat cloud and worker credentials stored on the server as exposed.
GPUStack vulnerability compromise check: six steps to find installs, confirm version, audit API keys and backends, rotate credentials

For Your Security Team

CVE-2026-102895 · GHSA-gj9m-f8ph-pmhr · CVSS v3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) · CWE-287, CWE-290, CWE-346 · Affected: before 2.2.0 · Fixed: 2.2.0 · CISA KEV: added 9 November, due 12 November · EPSS: 0.0033 on 9 November

Credit: Nikko Enggaliano, Wei Yunzhou, Rui Yang and Haoyu Wang (Johns Hopkins University) reported the flaw independently. Javier Sixto (ulex.fr) reported the attacks.

Frequently Asked Questions

What is the GPUStack vulnerability?
CVE-2026-102895 is a critical authentication bypass in GPUStack before 2.2.0. The server treated requests that looked local as the built-in administrator, so an outsider behind the same-machine proxy, or one sending a spoofed X-GPUStack-Real-IP header, could gain admin access without a password.
Which versions are affected and which version fixes it?
All releases before 2.2.0 are affected, and 2.2.0 fixes this flaw. Go to the latest release, because 2.2.2 also closes a separate critical login bypass.
Has the GPUStack vulnerability been exploited?
Yes. The advisory says attackers used it against a 2.1.1 deployment and created custom inference backends that ran reverse shells. CISA added it to the KEV catalog on 9 November. No victim count or indicators of compromise have been published.
What should I do if I cannot upgrade today?
Set force_auth_localhost to true, strip the X-GPUStack-Real-IP header at your reverse proxy, block outside access to /auth/saml/callback, and keep the management plane off the internet until you can upgrade.
How do I check whether my GPUStack server was compromised?
Review admin API keys and inference backends that nobody on your team created, revoke or remove them, and rotate the cloud provider and worker credentials stored on the server.

Other News