GPUStack authentication bypass CVE-2026-102895 joins CISA's exploited list; the fix has been out since June

CISA added CVE-2026-102895 to its Known Exploited Vulnerabilities catalog on November 9, 2026, with a remediation deadline of November 12 for federal agencies, and GPUStack published its security advisory on the authentication bypass the same day. The flaw sits in GPUStack, an open-source GPU cluster manager used to run AI models across GPU servers. In versions before 2.2.0, the software treated any request that appeared to come from the machine itself (127.0.0.1) as the built-in administrator when the force_auth_localhost setting was off — which was the default.

That shortcut is dangerous in the standard self-hosted setup, where a reverse proxy on the same machine forwards every visitor's request from 127.0.0.1, and a forged X-GPUStack-Real-IP header works too. Either path gives an unauthenticated attacker full administrative access: changing users and models, minting persistent admin API keys, reading worker and cloud-provider secrets, and executing code on worker hosts through custom inference backends. GPUStack says the flaw was exploited in the wild against a deployment running version 2.1.1, where attackers created backends that ran reverse shells. The CVE record, published November 4, scores it 9.8 out of 10 (critical).

Unusually, the fix predates the warning: GPUStack 2.2.0 removed the loopback shortcut and was released on June 18, 2026, months before the CVE record appeared — so any deployment that stayed on 2.1.x is exposed despite a patch being available all along. CISA's listing also flags the flaw for forensic triage, a sign defenders should check reachable servers for signs of compromise, not just patch them.