GPUStack Loopback Authentication Bypass (CVE-2026-102895)

CVE-2026-102895 is an authentication gap in GPUStack, an open-source GPU cluster manager for AI model serving and GPU provisioning. The advisory says the function that identifies a caller, get_current_user, treats a request as the built-in administrator whenever the request appears to come from the loopback (localhost) address.
GPUStack does not ask that caller for a password in that case, under a setting named force_auth_localhost that defaults to false. The advisory names two ways a remote caller can make a request look like it came from loopback.
One is a same-host reverse proxy in front of GPUStack, where every proxied connection already looks like it originates from loopback. The advisory separately says GPUStack also trusted a caller-supplied signal that claimed the same origin. We leave out the exact mechanics on purpose.
What CVE-2026-102895 Allows an Attacker to Do
The advisory says either path grants full unauthenticated administrative access over the network. It lists the ability to enumerate and change users, models and workers, to create administrator API keys that stay valid afterward, and to read worker credentials and cloud-provider secrets.
The advisory adds that this access reaches an admin-only function that builds a new inference backend from a supplied configuration, and that the path can run code on worker machines. Our least privilege entry explains the control this flaw removes. GitHub's advisory states that exploitation was observed in the wild against a GPUStack 2.1.1 deployment, where an attacker created custom backends that ran reverse shells.
How the Score Reads
GitHub, the CNA, scores it CVSS 3.1 9.8 Critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. There is no CVSS 4.0 score in the record or NVD. NVD lists the entry as Analyzed, first published 4 November 2026.
The weaknesses the advisory gives are CWE-287 (improper authentication), CWE-290 (authentication bypass by spoofing) and CWE-346 (origin validation error). See our CVSS entry for how to read the vector.
What the Maintainers and CISA KEV Say
The advisory names 2.2.0 as the first fixed release and says it removes the loopback administrator path. CISA added CVE-2026-102895 to the Known Exploited Vulnerabilities catalog on 9 November 2026, with a remediation due date of 12 November 2026. Our KEV glossary entry explains the catalog.

The advisory lists the gpustack Python package before 2.2.0 as affected and names 2.2.0 as the fixed release. GitHub's release page dates 2.2.0 to 18 June 2026, well before the advisory and the CISA KEV listing.

GitHub's pull request record shows the fix itself. The maintainers titled it removing the loopback auto-admin path, and merged it on 19 May 2026, a month before the 2.2.0 release that shipped it.
The advisory credits Nikko Enggaliano, Wei Yunzhou, and Rui Yang and Haoyu Wang of Johns Hopkins University as independent finders of the authentication gap. It credits a separate researcher, Javier Sixto, for reporting the in-the-wild exploitation. Our Kubeflow Pipelines authorization bypass entry covers a similar access-control gap in another self-hosted AI platform.