{"slug": "gpustack-cve-2026-102895-auth-bypass-exploited-patch-now", "title": "GPUStack CVE-2026-102895: Auth Bypass Exploited — Patch Now", "summary": "CISA added CVE-2026-102895, a CVSS 9.8 authentication bypass in the open-source GPUStack GPU cluster manager, to its Known Exploited Vulnerabilities catalog on November 9 with a November 12 remediation deadline after exploitation was confirmed in the wild against a v2.1.1 deployment. The flaw in `gpustack/api/auth.py` promotes any request from 127.0.0.1 to built-in administrator because `force_auth_localhost` defaults to false, and attackers can trigger it by sending the header `X-GPUStack-Real-IP: 127.0.0.1` directly to the API port, then POST a malicious backend to `/v2/inference-backends/from-yaml` for remote code execution and persistent admin API keys. GPUStack 2.2.0 fixed the core authentication logic and 2.2.2 adds hardening; operators unable to patch immediately can set `force_auth_localhost=true`, strip the header at the reverse proxy, or firewall the API port.", "body_md": "If you self-host LLMs with GPUStack, stop what you’re doing. CVE-2026-102895 — a CVSS 9.8 authentication bypass — is being [actively exploited in the wild right now](https://securityonline.info/gpustack-authentication-bypass-cve-2026-102895-exploited/). Attackers need zero credentials to gain full admin access to your AI server. CISA added it to the [Known Exploited Vulnerabilities catalog](https://www.esecurityplanet.com/vulnerabilities/news-cisa-kev-gpustack-freeswitch-openssh-ibm-november-2026/) on November 9 with a November 12 remediation deadline. The fix is one command. Run it.\n\n## What GPUStack Is\n\nGPUStack is an open-source GPU cluster manager (Apache 2.0) that pools multiple GPU servers into a unified cluster for LLM inference. It manages vLLM, SGLang, and TensorRT-LLM backends, handles load balancing, provides RBAC, and exposes a unified API — essentially Ollama for teams. If you’re self-hosting Llama, Mistral, or Qwen at any scale beyond a single machine, there’s a good chance you’re running GPUStack.\n\n## The Flaw: Trusting Loopback in 2026\n\nThe vulnerability lives in `gpustack/api/auth.py`, in the `get_current_user` function. By default, `force_auth_localhost` is `false`, and the function promotes any request arriving from `127.0.0.1` to the built-in administrator — no token, no password, no checks.\n\nThere are two ways attackers exploit this. The first is structural: if GPUStack sits behind a reverse proxy on the same host (Nginx, Traefik, Caddy — the standard setup), every remote request arrives at GPUStack with TCP peer `127.0.0.1`. Everyone on the internet becomes admin. The second vector is worse: an attacker can send the HTTP header `X-GPUStack-Real-IP: 127.0.0.1` directly to GPUStack’s API port and bypass auth entirely, no proxy required.\n\nTrusting network topology over credentials in 2026 is an inexcusable design decision. The [official advisory](https://advisories.gitlab.com/pypi/gpustack/CVE-2026-102895/) confirms the fix required a full rewrite of the loopback trust logic. The default should have been `force_auth_localhost=true` from day one.\n\n## What the Attack Looks Like\n\nExploitation of a live v2.1.1 deployment has been confirmed. The [full RCE chain](https://blog.ostorlab.co/gpustack-auth-bypass-rce-cve-2026-102895.html) is clean and fast:\n\n1. Forge the `X-GPUStack-Real-IP: 127.0.0.1` header on any request to the API\n2. Gain full administrator access — enumerate users, models, workers, and cloud credentials\n3. POST a malicious backend to `/v2/inference-backends/from-yaml` to execute arbitrary commands on the host\n4. Create persistent admin API keys to maintain access after the session ends\n5. Exfiltrate cloud provider credentials stored in worker configuration\n\nThe end result: reverse shell on your GPU server, persistent backdoor, and your AWS/GCP/Azure credentials in attacker hands. A public PoC exists. This is not theoretical.\n\n## Patch It Now\n\nGPUStack 2.2.0 fixed the core authentication logic. Use 2.2.2, which includes additional hardening on top.\n\n```\n# Check current version\ngpustack version\n# or: pip show gpustack | grep Version\n\n# Upgrade\npip install --upgrade \"gpustack>=2.2.2\"\n```\n\nFor Docker deployments:\n\n```\ndocker pull gpustack/gpustack:v2.2.2\n```\n\n## If You Can’t Patch Today\n\nThree mitigations reduce exposure while you plan the upgrade:\n\n1. Set `force_auth_localhost=true` in your GPUStack configuration — this disables the loopback auto-admin behavior\n2. Strip the `X-GPUStack-Real-IP` header at your reverse proxy before it reaches GPUStack (Nginx:`proxy_set_header X-GPUStack-Real-IP \"\";` )\n3. Firewall the GPUStack API port — it must not be reachable from the public internet without VPN or edge authentication\n\nThese mitigations reduce the attack surface but do not eliminate it. Upgrade.\n\n## Post-Compromise Checklist\n\nIf you ran a vulnerable version with the API accessible, treat the system as compromised until proven otherwise:\n\n- Audit all API keys — revoke any you did not create\n- Review all inference backends for unexpected or malicious entries\n- Rotate every cloud provider credential stored in GPUStack\n- Review worker node configurations for unauthorized changes\n- Check system logs for POST requests to `/v2/inference-backends/from-yaml`\n\n## The Bigger Picture\n\nCVE-2026-102895 landed in the same CISA KEV batch as OpenSSH SSHole (CVE-2026-123158). It is the first AI inference tool to reach the KEV catalog. That is not a coincidence — attackers are actively targeting AI infrastructure for GPU compute, model access, and the cloud credentials that live alongside inference workloads. If you manage self-hosted AI infrastructure, you are now a priority target. Treat your AI server with the same security rigor you’d apply to a database server.", "url": "https://wpnews.pro/news/gpustack-cve-2026-102895-auth-bypass-exploited-patch-now", "canonical_source": "https://byteiota.com/gpustack-cve-2026-102895-auth-bypass-exploited-patch-now/", "published_at": "2026-11-10 13:08:21+00:00", "updated_at": "2026-11-10 13:49:38.121318+00:00", "lang": "en", "topics": ["ai-infrastructure", "ai-safety", "mlops", "ai-policy"], "entities": ["GPUStack", "CISA", "CVE-2026-102895", "vLLM", "SGLang", "TensorRT-LLM", "Nginx", "Ostorlab"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/gpustack-cve-2026-102895-auth-bypass-exploited-patch-now", "markdown": "https://wpnews.pro/news/gpustack-cve-2026-102895-auth-bypass-exploited-patch-now.md", "text": "https://wpnews.pro/news/gpustack-cve-2026-102895-auth-bypass-exploited-patch-now.txt", "jsonld": "https://wpnews.pro/news/gpustack-cve-2026-102895-auth-bypass-exploited-patch-now.jsonld"}}