CVE-2026-102895: Unauthenticated Administrative Access and Remote Code Execution via Loopback Spoofing in GPUStack

Vulnerability ID: CVE-2026-102895
CVSS Score: 9.8
Published: 2026-11-09

CVE-2026-102895 is an improper authentication and origin validation vulnerability in GPUStack versions prior to 2.2.0. By default, the API authentication dependency in gpustack/api/auth.py grants built-in administrator privileges to unauthenticated requests resolved as originating from 127.0.0.1 when the force_auth_localhost flag is false. Because client IP resolution trusts same-host reverse proxy TCP peers and unvalidated X-GPUStack-Real-IP headers, remote unauthenticated attackers can bypass authentication, obtain full administrative control, extract sensitive credentials, and achieve remote code execution via the /v2/inference-backends/from-yaml endpoint.

TL;DR

An authentication bypass in GPUStack (< 2.2.0) allows remote unauthenticated attackers to gain full administrator access by spoofing the X-GPUStack-Real-IP header to 127.0.0.1 or routing requests through a same-host reverse proxy, leading to credential theft and remote code execution.

⚠️ Exploit Status: ACTIVE

Technical Details

• CWE ID: CWE-287 (Improper Authentication), CWE-290, CWE-346
• CVSS v3.1 Score: 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
• Attack Vector: Network (Unauthenticated HTTP via X-GPUStack-Real-IP or Reverse Proxy)
• Affected Component: get_current_user in gpustack/api/auth.py
• Primary Impact: Unauthenticated Admin Access, Secret Exfiltration, and RCE via /v2/inference-backends/from-yaml
• Exploit Status: Actively Exploited in the Wild (Observed on v2.1.1)
• CISA KEV Status: Listed (Added 2026-11-09, Due 2026-11-12)
• EPSS Score: 0.33% (26.46th Percentile)

Affected Systems

• GPUStack (< 2.2.0)
• GPUStack: < 2.2.0 (including v0.6.1, v0.7.0, v0.7.1, v2.0.0, v2.0.1, v2.0.2, v2.1.0, v2.1.1) (Fixed in: 2.2.0)

Code Analysis

Commit: 53f42a6

Remove automatic admin elevation for 127.0.0.1 in get_current_user and deprecate force_auth_localhost (PR #5346)

diff --git a/gpustack/api/auth.py b/gpustack/api/auth.py
index 3b6f0f7f58..e71af95038 100644
--- a/gpustack/api/auth.py
+++ b/gpustack/api/auth.py
@@ -120,9 +120,6 @@ async def get_current_user(
             if token is not None:
                 user, api_key = await get_user_from_api_token(session, token)

-        if user is None and client_ip_getter(request=request) == "127.0.0.1":
-            if not server_config.force_auth_localhost:
-                user = await User.first_by_field(session, "is_admin", True)
         if user:
             if not user.is_active:
                 raise UnauthorizedException(message="User account is deactivated")

Mitigation Strategies

• Upgrade GPUStack to version 2.2.0 or later to completely remove loopback-based implicit authentication.
• Enable force_auth_localhost on versions prior to 2.2.0 to require authentication tokens for all 127.0.0.1 requests.
• Configure upstream reverse proxies and ingress controllers to strip or overwrite the X-GPUStack-Real-IP header with the true TCP client IP ($remote_addr).
• Restrict network access to the GPUStack management API port (default 30080) using firewall rules or VPN boundaries.
• Audit existing API keys, user accounts, and custom inference backend definitions for signs of post-exploitation persistence, and rotate stored cloud credentials.

Remediation Steps:

1. Pull the patched GPUStack release or container image (gpustack/gpustack:v2.2.0) from https://github.com/gpustack/gpustack/releases/tag/v2.2.0 and restart the server service.
2. If running a version prior to 2.2.0, set GPUSTACK_FORCE_AUTH_LOCALHOST=true in the service environment or add force_auth_localhost: true to config.yaml and restart the GPUStack server.
3. Update reverse proxy configurations (e.g., Nginx, Envoy, Higress) to set proxy_set_header X-GPUStack-Real-IP $remote_addr; before forwarding requests to GPUStack.
4. Query the apikeys table in the GPUStack database (SELECT id, name, user_id, created_at, expires_at FROM apikeys ORDER BY created_at DESC;) and delete any unfamiliar keys.
5. Inspect all registered inference backends via the API or database to verify that no unauthorized YAML configurations or shell commands have been added.
6. Rotate all cloud provider credentials and worker node enrollment secrets stored in the cluster.

References

• NVD CVE-2026-102895 Record
• CVE.org Official Entry for CVE-2026-102895
• GitHub Security Advisory GHSA-gj9m-f8ph-pmhr
• Official Security Patch Commit (53f42a6a553542974396d16a4ff6b12bcbedb48d)
• GPUStack Security Pull Request #5346
• GPUStack v2.2.0 Release Notes
• CISA Known Exploited Vulnerabilities (KEV) Catalog Entry
• CISA BOD 26-04 Directive
• CISA Forensics Triage and Implementation Guidance

Read the full report for CVE-2026-102895 on our website for more details including interactive diagrams and full exploit analysis.