GPUStack patches critical SAML bypass and Kubernetes proxy flaw

GPUStack, a self-hosted GPU and LLM cluster manager, disclosed and fixed two security advisories in version 2.2.2 on November 10, 2026, according to the GPUStack SAML authentication bypass advisory. One is a critical, unauthenticated SAML login flaw enabling full account takeover; the other is a high severity bug letting any user reach other users' Kubernetes clusters.

What changed in version 2.2.2

• CVE-2026-102894 (GHSA-62m9-f875-rqw6): critical severity, CVSS 3.1 score 9.1, published November 10, 2026. GPUStack's SAML callback base64-decodes the posted response and issues a session JWT without calling OneLogin_Saml2_Auth.process_response(), skipping signature, issuer, audience, destination and time checks.
• The flaw works even when SAML SSO is not configured, letting an attacker impersonate any existing user, including admins, or create new accounts, with no credentials required.
• The GPUStack Kubernetes proxy authorization advisory (CVE-2026-103002, GHSA-3hch-x692-6qj3) is high severity, with a CVSS 3.1 score of 8.8, also published November 10, 2026. Its cluster_apiserver_proxy handler forwards requests to Kubernetes clusters using worker-node ServiceAccount credentials with no resource-level authorization check.
• Affected versions are 0.7.1 through 2.2.1 for the SAML flaw, and 2.2.0 through 2.2.1 (including 2.2.1rc1) for the proxy flaw; both are fixed in version 2.2.2.
• Until upgrading, GPUStack recommends blocking the SAML callback endpoint and restricting access to trusted admins only.

What it means for teams self-hosting AI infrastructure

GPUStack is widely used to self-host open LLM inference clusters, so an unauthenticated account takeover bug alongside a cross-tenant Kubernetes access bug in the same platform raises the stakes for teams operating it. The bypass needs no valid credentials to reach admin access, while the authorization bug lets even a non-admin user reach Kubernetes clusters they were never granted. Arriving the same week a separate GPUStack vulnerability was added to CISA's Known Exploited Vulnerabilities catalog, the pair of advisories is a serious signal to review how self-hosted AI infrastructure is exposed.

Mitigation and next steps

Teams running affected GPUStack deployments should upgrade to version 2.2.2, which fixes both advisories. Until the upgrade is complete, blocking the SAML callback endpoint and limiting access to trusted administrators are the recommended interim steps.

Sources

• GPUStack SAML Authentication Bypass Leading to Account Takeover (GitHub Security Advisories, November 10, 2026, official)
• GPUStack Missing Authorization on Cluster API Server Proxy (GitHub Security Advisories, November 10, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.