CVE-2026-102895: GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, getcurrentuser in gpustack/api/auth.py treated a loopback request source as the built-in administrator when forceauthlocalhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because clientipgetter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPUStackto a version that resolves this vulnerability.Fixed in 2.2.0
Event History
Frequently Asked Questions
Which deployments are exposed?
GPUStack deployments running versions prior to 2.2.0 are exposed when force_auth_localhost is false, which was the default. Remote attackers can exploit the condition through a same-host reverse proxy peer or by supplying an X-GPUStack-Real-IP value of 127.0.0.1.
What level of access can an attacker gain?
An attacker can obtain unauthenticated administrator access. This permits user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml.
Has this vulnerability been exploited?
Yes. Exploitation was observed in the wild against a GPUStack 2.1.1 deployment.
What is the available fix?
Upgrade GPUStack to version 2.2.0, which fixes the authentication bypass.