GPUSTACK · CVE-2026-102894 · AI agents & MCP
FIX → 2.2.2 ✓ verified
GPUStack, a GPU cluster manager for serving AI models, accepted SAML login responses without checking their signature, issuer, audience or timing. An attacker can submit any identity, including an administrator's, and receive a valid session token, even when SAML is not configured.
first public Sep 30, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Every GPUStack deployment from 0.7.1 up to but not including 2.2.2 is exposed, because the SAML callback runs whether or not SAML is configured. Anyone who can reach /auth/saml/callback over the network, with no credentials, can get a session as any existing user, including an administrator, or create a new non-admin user. Self-hosted GPU/AI serving clusters reachable from untrusted networks are the main concern; 2.2.2 and later can skip it.
Not affected if network-restricted, version-2.2.2-or-later
Who cares ai-models, gpu, gpustack, self-hosted
pip show gpustack (or check the GPUStack version in the UI); any version >= 0.7.1 and < 2.2.2 is vulnerable, whether or not SAML is configuredGPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2.2.2
2.2.2 (pip install -U gpustack>=2.2.2). 2.2.2 validates SAML responses with OneLogin_Saml2_Auth.process_response() and only enables SAML/OIDC routes when that provider is the configured active oneNVD data is provided by NIST and is public domain. Posts quoted belong to their authors.