Exploited in the wildCRITICALCISA KEV

GPUStack auth bypass grants unauthenticated admin, exploited to run worker shells

GPUStack servers before 2.2.0 in default configuration treat loopback-looking requests as the built-in admin. A same-host reverse proxy or a spoofed header gives remote attackers full control. The flaw is in CISA KEV. Upgrade to 2.2.0, then hunt for rogue backends and API keys.

GPUStack (pip package gpustack)CVE-2026-102895CVSS9.8CWE-287AI & dev tools
Published Nov 10, 2026

The vendor reports exploitation of a v2.1.1 deployment, where attackers created custom backends that ran reverse shells. CISA added the CVE to KEV on 2026-11-09 with a federal due date of 2026-11-12.

Jul 31, 2026104 daysNov 12, 2026

What you need to know

  • Exposed: GPUStack servers below 2.2.0 with the default force_auth_localhost=false. Instances behind a same-host reverse proxy are exploitable without any special header.
  • Impact: an unauthenticated network attacker becomes the built-in admin. That means control of users, models and workers, access to stored secrets, and code execution on workers through custom inference backends.
  • Exploited in the wild against v2.1.1, with reverse shells run from custom backends. In CISA KEV since 2026-11-09, federal due date 2026-11-12. No actor, scale or IOCs have been published.
  • Fix: upgrade to 2.2.0 or later. If you cannot yet, set force_auth_localhost=true and strip X-GPUStack-Real-IP at the edge. Admin API keys an attacker created stay valid, so revoke them.
  • Detect: look for unknown inference backends, admin API keys and users. Check proxy logs for POSTs to /v2/inference-backends/from-yaml.

What's happening

GPUStack is an open-source cluster manager for serving AI models on GPU hardware. It grants the built-in administrator role to any request it believes came from loopback 1. In default configurations before 2.2.0, an unauthenticated attacker with network access to the server API can take full administrative control, with no user interaction 1.

The maintainer's advisory was published 2026-07-31. It states the bug was exploited against a GPUStack v2.1.1 deployment, where attackers created custom inference backends that launched reverse shells 1. The vendor credits Javier Sixto of ulex.fr with reporting the activity 1. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-11-09 and set a federal due date of 2026-11-12 3,6. CISA requires forensic triage and lists ransomware use as unknown 3.

The CVE record was published on 2026-11-04, more than three months after the advisory 4. No threat actor has been named. No exposure counts, scanning telemetry or indicators have been released. Press coverage of the KEV addition repeats the vendor's account without adding independent GPUStack data 5,6.

How it works

The bug is authentication bypass by spoofing. The advisory lists CWE-287, CWE-290 and CWE-346 1. The get_current_user function in gpustack/api/auth.py uses the request's network source as an authentication signal 1. It maps any source that looks like loopback to the built-in administrator 1. That branch is active when force_auth_localhost is false, which is the default 1.

The source address comes from client_ip_getter, which can report loopback in two ways 1. First, when GPUStack runs behind a reverse proxy on the same host, every remote request arrives with a loopback TCP peer 1. The vendor calls this common self-hosted layout exploitable without any header at all 1. Second, a forged X-GPUStack-Real-IP header from a client can make the server treat the request as coming from loopback 1.

Admin access leads to code execution. The admin-only endpoint POST /v2/inference-backends/from-yaml lets an attacker define backends that run on worker hosts 1. Admin access also exposes worker credentials and cloud-provider secrets 1. It also lets an attacker create persistent wildcard-scope admin API keys, which the advisory says remain valid from any source IP 1. The advisory does not say the upgrade revokes them. Version 2.2.0 removes the loopback auto-admin path and hardens client-IP and forwarding-header handling 1. On the fix pull request, a maintainer asked for force_auth_localhost to be kept as a deprecated no-op for now 2.

What to do

In order of priority
  1. 1

    Upgrade gpustack to 2.2.0 or later 1. The latest release is the safer target. Federal agencies must act by 2026-11-12 under BOD 26-04, or stop using the product if mitigations are unavailable 3,5.

  2. 2

    If you cannot upgrade immediately, set force_auth_localhost=true so loopback requests also require authentication 1. The fix pull request indicates the setting is being kept only as a deprecated no-op 2.

  3. 3

    Configure the reverse proxy or gateway so external traffic cannot appear as loopback, and strip any client-supplied X-GPUStack-Real-IP header at the edge 1.

  4. 4

    Keep the GPUStack API off untrusted networks. Put it behind a VPN or edge authentication 1.

  5. 5

    If an instance was reachable before patching, treat it as potentially compromised. Revoke and reissue admin API keys, then remove users, models and inference backends nobody created 1.

  6. 6

    Rotate worker credentials and any cloud or provider secrets stored in GPUStack 1.

  7. 7

    Perform forensic triage on servers and worker hosts as CISA requires 3. Look for reverse shells and persistence, and rebuild any worker host found running attacker-defined backends 1.

Detection

  • Inventory GPUStack servers and confirm versions, for example with pip show gpustack on pip installs. Any server below 2.2.0 with force_auth_localhost unset or false is exposed 1.
  • List configured inference backends and compare them against what your team deployed. In the observed attack, the attackers created custom backends that ran reverse shells 1.
  • On worker hosts, hunt for reverse-shell activity 1. Look for shell processes spawned under GPUStack backends or their container runtime, and for outbound connections to unfamiliar hosts.
  • Behind a same-host proxy, GPUStack sees every request as coming from loopback 1. Use the reverse-proxy or edge logs to find unauthenticated requests to admin endpoints, especially POST /v2/inference-backends/from-yaml 1.
  • Flag inbound requests where a client set an X-GPUStack-Real-IP header. That header is the spoofing vector 1.
  • Audit admin API keys, especially wildcard-scope keys, along with users and models. Look for entries nobody on the team created. Such keys remain valid from any source IP 1, and upgrading does not remove them.
  • Treat this as a forensic question, not only a patching task. CISA's entry requires checking whether the system was compromised before the patch was applied 3.

Timeline

  1. GPUStack publishes advisory GHSA-gj9m-f8ph-pmhr. It reports in-the-wild exploitation against v2.1.1 and lists 2.2.0 as the fix. 1

  2. CVE-2026-102895 is published by the GitHub CNA. 4

  3. CISA adds CVE-2026-102895 to the KEV catalog and requires forensic triage. 3

  4. SecurityWeek reports the flaw as exploited, saying it was flagged as exploited at the end of July. 5

  5. The Hacker News covers the KEV addition and repeats the vendor's exploitation credit. 6

  6. KEV remediation due date for US federal agencies. 3

Sources

  1. 1
    Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
    GPUStack (GitHub Security Advisory) · Vendor · Jul 31, 2026
  2. 2
    refactor: remove localhost auto-admin bypass
    GPUStack (GitHub) · Vendor
  3. 3
    CISA KEV entry for CVE-2026-102895 (GPUStack Improper Authentication Vulnerability)
    CISA · Government · Nov 9, 2026
  4. 4
    CVE-2026-102895 CVE Record
    CVE Program / GitHub CNA · Database · Nov 4, 2026
  5. 5
    IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks
    SecurityWeek · News · Nov 10, 2026
  6. 6
    CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws
    The Hacker News · News · Nov 10, 2026

Confirmed by vendor and government. Researched and drafted by the VulnDigest briefs agent from 6 sources, then checked against them by a separate review step on Nov 10, 2026.

The GPUStack maintainers report the exploitation, based on one observed attack on a v2.1.1 deployment, and CISA lists the flaw in KEV. No independent telemetry, exposure counts, actor attribution or IOCs have been published.

The vendor advisory itself shows no CVE ID. The link between GHSA-gj9m-f8ph-pmhr and CVE-2026-102895 comes from the CVE and KEV listings and from news coverage.

KEV details such as the forensic triage requirement and the unknown ransomware status come from the CISA catalog entry, which we could not load directly. News reports confirm the 2026-11-09 addition and the 2026-11-12 due date.

It is not known when exploitation began or whether the fixed release shipped before the attacks, so zero-day status and first-seen date are unknown.

Some unofficial sources say 2.2.0 was first distributed as a container image rather than on PyPI. The advisory lists the pip package as patched at 2.2.0. Confirm that your install channel shows 2.2.0 or later.

Other GPUStack security issues have been reported but were not reviewed for this brief. Upgrading to the latest release is safer than stopping at 2.2.0.

Spotted an error? Open an issue on sochub.io.