CISA adds actively exploited GPUStack flaw to Known Exploited Vulnerabilities catalog

On November 9, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-102895, a critical authentication-bypass vulnerability in the open-source GPU cluster manager GPUStack, to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild.

What changed

• CVE-2026-102895 carries a CVSS score of 9.8 (critical) and affects GPUStack, an open-source GPU cluster manager used for self-hosted AI model serving and GPU provisioning.
• The root cause sits in the get_current_user function in gpustack/api/auth.py, which grants unauthenticated built-in administrator access to any request that appears to come from loopback (127.0.0.1) when the default setting force_auth_localhost is false.
• Attackers can trigger the bypass through a same-host reverse-proxy setup, where all remote traffic arrives with TCP peer 127.0.0.1, or by forging an X-GPUStack-Real-IP: 127.0.0.1 header, with no credentials required.
• Remote code execution is reachable through POST requests to /v2/inference-backends/from-yaml, running arbitrary commands with the GPUStack service's privileges.
• CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 9, 2026, one of four vulnerabilities listed that day under alert BOD 26-04, alongside flaws in SignalWire FreeSwitch, OpenBSD OpenSSH and IBM Aspera Faspex.
• The issue is fixed in GPUStack version 2.2.0, which removes the loopback auto-admin path and hardens client-IP and forwarding-header handling.

What it means for people building with AI

Teams that self-host large language model or GPU infrastructure through GPUStack face confirmed, unauthenticated remote takeover of their serving stack, not a theoretical risk. CISA's November 9 listing is a fresh, authoritative signal that patching to version 2.2.0 is urgent, particularly for anyone running GPUStack behind a reverse proxy on the same host or exposed to networks where the X-GPUStack-Real-IP header could be forged.

Fix and advisory details

GPUStack 2.2.0 closes the loopback auto-admin path and hardens client-IP and forwarding-header handling. The underlying flaw is documented in the GitHub Security Advisory GHSA-gj9m-f8ph-pmhr, originally published July 31, 2026, well before CISA's catalog addition.

Sources

• CISA Adds Four Known Exploited Vulnerabilities to Catalog (CISA, November 9, 2026, official)
• GHSA-gj9m-f8ph-pmhr: Authentication bypass via trusted loopback source grants unauthenticated admin (GitHub / GPUStack, July 31, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.