Skip to content

GPUStack admin bypass in CISA KEV: CVE-2026-102895

CISA added GPUStack flaw CVE-2026-102895 to its Known Exploited Vulnerabilities catalog on 9 November 2026: GPUStack before 2.2.0 can treat a remote request as coming from localhost and give it the built-in administrator account, with no credentials. Teams that self-host GPUStack to run AI models on their own GPU servers should upgrade to 2.2.0 or later now; CISA's federal due date is 12 November 2026.

Do this today

What: GPUStack improper authentication, CVE-2026-102895, in CISA's KEV catalog since 9 November 2026. The vendor says it "has been observed exploited in the wild".
Who is exposed: anyone running a GPUStack server older than 2.2.0, above all behind a reverse proxy on the same host or reachable from an untrusted network.
The one action: check the running GPUStack version and upgrade every server below 2.2.0. CISA's due date: 12 November 2026.
For the Microsoft 365 side of the same estate, the M365 Hardening Kit has a free Top 10 with read-only checks.

Runbook card

What changes: nothing on your side changes by itself. A known, exploited flaw lets anyone who can reach the GPUStack API act as its administrator: change users and models, create persistent admin API keys, read worker and cloud-provider secrets, and run code on worker hosts.
Who: GPUStack servers before 2.2.0 (pip package gpustack, versions "< 2.2.0").
By when: now. CISA due date for US federal agencies: 12 November 2026.
Do this: 1. Find every GPUStack server you run, including test and lab GPU boxes. 2. Upgrade to 2.2.0 or later; until then set force_auth_localhost=true, strip any client-supplied X-GPUStack-Real-IP header at the proxy and keep the API off untrusted networks. 3. On any server that was reachable, review admin API keys, users and inference backends, and rotate worker credentials and cloud-provider secrets you cannot rule out.
Check: pip show gpustack (Version line) on the server, or the image tag of the running GPUStack container.
Source: GPUStack advisory GHSA-gj9m-f8ph-pmhr and the CISA KEV catalog (catalog version 2026.11.09).

What GPUStack and CISA say

GPUStack's advisory GHSA-gj9m-f8ph-pmhr is titled "Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin". It rates the flaw Critical, CVSS 9.8 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with weaknesses CWE-287, CWE-290 and CWE-346.

The cause: before 2.2.0, GPUStack gives any request it believes came from loopback the built-in administrator account when force_auth_localhost is false, which is the default. The advisory names two ways a remote request ends up looking local:

  • A reverse proxy on the same host. If GPUStack sits behind a proxy that forwards to 127.0.0.1, every remote request arrives from 127.0.0.1. No header or credential is needed. The advisory calls this "the canonical self-hosted shape".
  • A forged header. A request carrying X-GPUStack-Real-IP: 127.0.0.1 can be treated as loopback.

The advisory says the flaw "has been observed exploited in the wild against a v2.1.1 deployment", with attacker-created custom backends running reverse shells. Admin API keys created this way have scope ["*"] and keep working from any source IP after the upgrade, so upgrading alone does not remove an attacker who already got in.

CISA added CVE-2026-102895 to the KEV catalog on 9 November 2026 as "GPUStack Improper Authentication Vulnerability", due 12 November 2026. Use in ransomware campaigns is listed as "Unknown". CISA's required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

What is not public yet: neither GPUStack nor CISA has published indicators of compromise, attack dates or how many servers were hit.

Affected and fixed versions

Package Affected Fixed
gpustack (pip, and the server built from it) before 2.2.0 2.2.0 and later

GPUStack says 2.2.0 removes the loopback auto-admin path and hardens client-IP and forwarding-header handling.

How to check (read-only)

# Installed from pip: the Version line must be 2.2.0 or higher
pip show gpustack

# Running in Docker: list GPUStack containers and their image tags
docker ps --format '{{.Names}}  {{.Image}}' | grep -i gpustack

Then check exposure: is the GPUStack API reachable from the internet or another untrusted network, and does a reverse proxy on the same host forward to 127.0.0.1? Both raise the risk on any version below 2.2.0.

Our suggested review, not vendor guidance, for any server that ran a vulnerable version while reachable: in the GPUStack admin interface, list API keys, users and inference backends, and explain every entry you did not create. The advisory names custom backends running reverse shells as the attack it saw.

How to verify the fix

After the upgrade, pip show gpustack (or the container image tag) shows 2.2.0 or later. Then send a request to the API through your proxy without credentials: it should be refused, not answered as admin.

Rollback and impact

The upgrade restarts the GPUStack server, so running model endpoints are down for a short time. Rotating worker credentials and cloud-provider secrets can break workers until they get the new values, so plan the order: upgrade, revoke unknown API keys, rotate, then restart workers.

Related: LiteLLM 1.107.0 supply-chain compromise for another AI infrastructure incident with secrets to rotate, the SonicWall SSL-VPN KEV brief, the M365 AI Agent Hardening Kit, more AI security news and Threats & vulnerabilities news.

Sources

Last reviewed: 9 November 2026. Runbook Lab is not affiliated with GPUStack or Microsoft.