GPUStack before 2.2.0 promotes requests treated as loopback to the built-in admin when force_auth_localhost is False (default), so attackers behind a same-host reverse proxy or with a forged X-GPUStack-Real-IP header gain unauthenticated admin access and can run code on workers via POST /v2/inference-backends/from-yaml [1]. GPUStack reports in-the-wild exploitation against a v2.1.1 deployment, and CISA added CVE-2026-102895 to KEV on Nov 9 [1][2]. Upgrade to 2.2.0 or later; otherwise set force_auth_localhost=true and strip client-supplied X-GPUStack-Real-IP at the edge [1].
GPUStack loopback-trust flaw CVE-2026-102895 exploited and added to KEV, grants unauthenticated admin
1 min read
- Disclosed
- Jul 31, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 10, 2026
- CVSS basis
- Our assessment
- 0.5%, higher than 44% of CVEs
- Exploitation and patch status
- ExploitedKEVPatch available
- Technology
- Attack vector
- Vulnerability status
- Actor type
On this page
30-second summary
What happened
Who is affected
Organisations running: GPUStack GPUStack
What to do nowOur advice
Upgrade to 2.2.0 or later; otherwise set force_auth_localhost=true and strip client-supplied X-GPUStack-Real-IP at the edge [1]
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| GPUStack GPUStack | < 2.2.0[1] | 2.2.0 | ✓ Patched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
Technical details
Remediation
References
Official / primary2
- [1]
“This vulnerability has been observed exploited in the wild against a v2.1.1 deployment (attacker-created custom backends running reverse shells).”
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.