CVE-2026-102895
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: gPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. EPSS 0.5% (44th percentile).
CISA federal remediation date Nov 12
Vulnerabilities & Exploits · Web App Attack
SANS observed live GPUStack authentication-bypass attempts from one source IP, 144.91.73.103. All versions before 2.2.0 are vulnerable. The same IP also probed endpoints associated with other AI services, though those requests do not show that any were compromised.
GPUStack trusts the X-Gpustack-Real-IP header to identify where a request came from. An attacker can set it to 127.0.0.1—the machine’s own loopback address—and GPUStack treats the caller as trusted, skipping authentication. A network caller can therefore reach the manager without credentials.
If an exposed GPUStack manager controls GPU clusters used for AI serving, a successful bypass could expose infrastructure beyond the manager itself. The probes of other AI endpoints widen the investigation, but remain a lead rather than evidence of additional victims.
1 source · Nov 12
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: gPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. EPSS 0.5% (44th percentile).
CISA federal remediation date Nov 12
SANS ISC
Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895)
Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), Author: Johannes Ullrich
originalPart of the PlainSec briefing for 2026-11-12
Every edition of this story: GPUStack's localhost spoofing skips authentication on exposed managers