Vulnerabilities · 18h ago

GPUStack's localhost spoofing skips authentication on exposed managers

SANS observed live GPUStack authentication-bypass attempts from one source IP, 144.91.73.103. All versions before 2.2.0 are vulnerable. The same IP also probed endpoints associated with other AI services, though those requests do not show that any were compromised.

GPUStack trusts the X-Gpustack-Real-IP header to identify where a request came from. An attacker can set it to 127.0.0.1—the machine’s own loopback address—and GPUStack treats the caller as trusted, skipping authentication. A network caller can therefore reach the manager without credentials.

If an exposed GPUStack manager controls GPU clusters used for AI serving, a successful bypass could expose infrastructure beyond the manager itself. The probes of other AI endpoints widen the investigation, but remain a lead rather than evidence of additional victims.

CVE-2026-102895

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: gPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. EPSS 0.5% (44th percentile).

CISA federal remediation date Nov 12

Timeline

Nov 12 Reported by SANS ISC
Nov 9 CVE-2026-102895 added to CISA KEV

Sources

1 source covering this story

SANS ISC Nov 12
Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895)
Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), Author: Johannes Ullrich

Entities

CVE-2026-102895

Part of the PlainSec briefing for 2026-11-13

Editions

Vulnerabilities · 18h agoGPUStack's localhost spoofing skips authentication on exposed managersSANS observed live GPUStack authentication-bypass attempts from one source IP, 144.91.73.103. All versions before 2.2.0 are vulnerable. The same IP also probed endpoints associated with other AI services, though those requests do not show that any were compromised.GPUStack trusts the X-Gpustack-Real-IP header to identify where a request came from. An attacker can set it to 127.0.0.1—the machine’s own loopback address—and GPUStack treats the caller as trusted, skipping authentication. A network caller can therefore reach the manager without credentials.If an exposed GPUStack manager controls GPU clusters used for AI serving, a successful bypass could expose infrastructure beyond the manager itself. The probes of other AI endpoints widen the investigation, but remain a lead rather than evidence of additional victims.