CVE-2026-102895: GPUStack hands out admin to proxies

Call: Patch now. GPUStack’s advisory says the bug “has been observed exploited in the wild against a v2.1.1 deployment,” with attackers creating custom backends that ran reverse shells. CISA added CVE-2026-102895 to KEV on November 9, due November 12. CVSS 9.8.

What breaks: Before 2.2.0, GPUStack treats any request from loopback as the built-in admin, unless force_auth_localhost is set, and it isn’t by default. Two ways to look like loopback without credentials:

• The normal setup. Put GPUStack behind a reverse proxy on the same host with proxy_pass http://127.0.0.1:<port>, and every remote request arrives from 127.0.0.1. No header trick needed.
• A forged X-GPUStack-Real-IP: 127.0.0.1 header.

Either way an attacker gets full admin: users, models, workers, persistent *-scope API keys, worker credentials and cloud provider secrets. Then POST /v2/inference-backends/from-yaml turns that into code execution on the worker hosts.

Who’s hit: GPUStack before 2.2.0, especially behind a same-host reverse proxy. That is a common way to run it.

Fix: GPUStack 2.2.0 or later. It removes the loopback auto-admin path. The fix shipped with the advisory on July 31, so this is about stragglers.

Workaround: Set force_auth_localhost=true, strip any client-supplied X-GPUStack-Real-IP header at the edge, and keep the API behind a VPN or edge auth. If you ran an older version on the internet, patching isn’t the end of it. Revoke and reissue API keys, rotate the worker and cloud provider secrets, and look for inference backends you didn’t create.

Sources: GPUStack advisory GHSA-gj9m-f8ph-pmhr (opens in a new tab)↗⁠, CISA KEV (opens in a new tab)↗⁠.

Sources

• https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr⁠↗ (opens in a new tab)
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog⁠↗ (opens in a new tab)