GPUStack CVE-2026-102895 Patch Deadline Explained: 9.8 Auth Bypass, CISA Deadline Today and How to Fix It

on

GPUStack CVE-2026-102895 patch deadline explained — server racks in a data centre

Illustrative image: server racks in a data centre. Image: NERSC, CC0, via Wikimedia Commons.

TL;DR: The GPUStack CVE-2026-102895 patch deadline is today, 12 November 2026. The 9.8-rated authentication bypass lets an unauthenticated attacker become an administrator on self-hosted GPUStack AI servers, and it has already been exploited in the wild. Upgrade to GPUStack 2.2.2 or later, and check for signs of compromise.

📌 Key Highlights

  • Deadline today: CISA added CVE-2026-102895 to its Known Exploited Vulnerabilities catalog on 9 November, with a federal remediation due date of 12 November 2026 under Binding Operational Directive 26-04.
  • Severity 9.8 (Critical): any request that looks like it comes from localhost (127.0.0.1) is treated as the built-in administrator — no password, no token.
  • Exploited in the wild: GPUStack's own advisory confirms the bypass was used against a deployment running version 2.1.1, where attackers created custom inference backends that ran reverse shells.
  • The fix: upgrade to GPUStack 2.2.2 or later. Version 2.2.0 closes this flaw; 2.2.2 also closes a second critical SAML bypass, CVE-2026-102894.
  • Who is affected: any GPUStack deployment before 2.2.0 with the default force_auth_localhost=false setting, especially servers behind a same-host reverse proxy.

GPUStack CVE-2026-102895 patch deadline explained: what happened

GPUStack is an open-source GPU cluster manager that teams use to run their own AI models — large language models, voice, image and video models — on their own hardware or cloud instances, through OpenAI-compatible APIs. It sits in the same niche as Ollama or a self-managed vLLM deployment, but for teams that want to pool GPUs across machines and manage them from one control plane.

On 9 November 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added a flaw in GPUStack, tracked as CVE-2026-102895, to its Known Exploited Vulnerabilities (KEV) catalog. CISA only adds a flaw to KEV when it has evidence of active exploitation, and it gave US federal civilian agencies three business days to fix it — a deadline that runs out today, 12 November 2026. The deadline binds federal agencies, but the risk is identical for everyone else running GPUStack: a 9.8-rated, remotely exploitable, unauthenticated admin takeover with documented in-the-wild use.

The CVE record was published on 4 November 2026. GPUStack's own security advisory, GHSA-gj9m-f8ph-pmhr, says the bypass "has been observed in the wild" against a deployment running version 2.1.1. CISA also flagged the entry for forensic triage — its signal that a system may already be compromised, not merely vulnerable.

How the bypass works

The flaw lives in a single function, get_current_user, in gpustack/api/auth.py. In GPUStack versions before 2.2.0, when a setting called force_auth_localhost is left at its default value of False, any request whose source is treated as "loopback" — coming from the server itself — is promoted to the built-in administrator account. The problem is that a request can be made to look like loopback traffic in two ways that need no credentials at all:

  • A same-host reverse proxy: in the standard self-hosted setup, GPUStack sits behind a reverse proxy on the same machine that forwards requests to 127.0.0.1. Every remote request then arrives at GPUStack with a TCP peer of 127.0.0.1, so the loopback auto-admin branch fires for anyone on the internet who can reach the proxy.
  • A forged header: a remote client can simply send an X-GPUStack-Real-IP: 127.0.0.1 header, and GPUStack treats the request as local.

Once past that check, the attacker has full administrator access: enumerate and change users, models, workers and configuration; create persistent administrator API keys with scope ["*"] that work from any IP; read worker credentials and cloud-provider secrets; and call admin-only endpoints such as POST /v2/inference-backends/from-yaml to push a custom backend definition — a direct path to code execution on worker hosts. In short, the server was trusting a network-position signal, or a client-controllable header, as proof of identity.

CVESeverityWhat it isAffected versionsFixed inIn CISA KEV?
CVE-2026-1028959.8 CriticalLoopback authentication bypass grants unauthenticated adminBefore 2.2.02.2.0Yes — due 12 Nov 2026
CVE-2026-1028949.1 CriticalSAML callback issues session tokens without verifying signatures0.7.1 to before 2.2.22.2.2No — not confirmed exploited

GPUStack CVE-2026-102895 patch deadline explained — server rack in a computing centre

Illustrative image: a server rack in the CERN Computer Centre. Image: Marián Hubinský, via Wikimedia Commons.

Why it matters for self-hosted AI teams

A GPUStack server is not a toy deployment. It typically holds API keys, worker credentials, cloud-provider secrets for provisioning GPU capacity, and the ability to push arbitrary inference-backend configuration to every worker node it controls. Breaking authentication on that server does not just expose chat logs — it hands an attacker the keys to the whole cluster, and through it, the GPUs and the data the models serve.

That is why this flaw matters beyond US federal agencies. GPUStack's real user base is state and local governments, universities, startups and enterprises that stood up their own model-serving infrastructure quickly — often outside central IT's patching routines. India has the same profile: research labs, startups and enterprises running self-hosted inference are exactly the deployments that tend to sit behind a same-host reverse proxy with default settings, and exactly the ones least likely to have seen the advisory. The lesson also travels: the SGLang breach at NEAR AI showed the same week that AI inference servers are now a prime target, and our CISA KEV November 2026 roundup listed this flaw alongside three others sharing the same 12 November deadline.

How to fix it today

If your organisation runs GPUStack anywhere — on-premises, in Kubernetes, or in the cloud — work through this checklist in order:

  1. Check your version. Anything before 2.2.0 is vulnerable to CVE-2026-102895; anything before 2.2.2 is also vulnerable to the SAML bypass, CVE-2026-102894.
  2. Upgrade to 2.2.2 or later. This single upgrade closes both flaws. Recreate containers rather than just pulling the new image, so the new process actually runs.
  3. If you cannot upgrade immediately, apply GPUStack's documented workarounds for CVE-2026-102895: set force_auth_localhost=true, strip any client-supplied X-GPUStack-Real-IP header at your edge or reverse proxy, and confirm your proxy cannot make external traffic look like loopback. For the SAML flaw there is no configuration workaround — block access to /auth/saml/callback at your proxy until you upgrade.
  4. Do not expose the GPUStack API or admin UI directly to the internet. Put it behind a VPN or an authenticated gateway regardless of patch status; that single change would have blocked both documented attack paths.
  5. Treat already-exposed instances as potentially compromised. Check for unexpected administrator API keys, unfamiliar inference-backend definitions, or worker processes you did not create — the documented in-the-wild exploitation created custom backends to run reverse shells.
  6. Rotate credentials after patching. If the instance was ever internet-facing, rotate worker credentials and any cloud-provider secrets GPUStack had access to, and revoke API keys you do not recognise.

Should you care?

✅ Yes, today — if you run GPUStack. Check your version now and upgrade to 2.2.2. If you do not run GPUStack, the takeaway still applies: any self-hosted AI tool that trusts "localhost" as proof of identity needs the same audit, because a reverse proxy makes every remote request look local. And if you run other software from the same KEV batch, the Cisco BroadWorks flaw added to KEV on 10 November carries a 24 November deadline — patch that one in the same maintenance window.

FAQs

What is CVE-2026-102895?
It is an improper authentication vulnerability in GPUStack, an open-source GPU cluster manager used to self-host AI inference workloads. It lets an unauthenticated attacker gain administrator access by exploiting how GPUStack treats certain requests as coming from localhost, either through a same-host reverse proxy or a forged X-GPUStack-Real-IP header.

What is the GPUStack CVE-2026-102895 patch deadline?
CISA set a due date of 12 November 2026 — three business days after the 9 November KEV addition. That deadline is legally binding only for US federal civilian agencies under Binding Operational Directive 26-04, but any organisation running GPUStack should treat it as a same-day priority given the 9.8 severity and confirmed exploitation.

Which GPUStack versions are affected?
Versions before 2.2.0 are vulnerable to CVE-2026-102895. A separate, related authentication bypass in GPUStack's SAML login callback, CVE-2026-102894, affects versions 0.7.1 up to but not including 2.2.2 and is not confirmed as actively exploited.

How do I fix it if I cannot upgrade right away?
GPUStack's advisory recommends setting force_auth_localhost=true, stripping any client-supplied X-GPUStack-Real-IP header at your reverse proxy, and keeping the GPUStack API off the open internet. There is no configuration workaround for the separate SAML bypass; block /auth/saml/callback at your proxy until you upgrade to 2.2.2.

Takeaway: The GPUStack flaw is a textbook case of trusting the network instead of the user — and it is already being exploited. The patch exists, the deadline is today, and the fix is one upgrade to 2.2.2. Check your version before the day ends.

If you run any self-hosted AI stack, open its admin panel today and confirm which version it is running — the same "localhost is trusted" shortcut hides in more tools than GPUStack.

Sources

Comments

Post a Comment