{"id":"CVE-2026-102894","kind":"vulnerability","aliases":["CVE-2026-102894"],"related":[],"title":"GPUStack: unsigned SAML login lets anyone impersonate administrators","description":"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2.","summary":"GPUStack, a GPU cluster manager for serving AI models, accepted SAML login responses without checking their signature, issuer, audience or timing. An attacker can submit any identity, including an administrator's, and receive a valid session token, even when SAML is not configured.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gpustack","fixed":["2.2.2"],"affected":">= 0.7.1, < 2.2.2","ecosystem":"pip"}],"ecosystems":[],"tags":["ai-models","ai-tooling","gpu","gpustack","self-hosted"],"not_affected_if":["network-restricted","version-2.2.2-or-later"],"how_to_check":"Run 'pip show gpustack' (or check the GPUStack version in the UI); any version >= 0.7.1 and < 2.2.2 is vulnerable, whether or not SAML is configured. Also check whether /auth/saml/callback is reachable from untrusted networks. If exposed, review admin logins and newly created users for unexpected accounts.","fix":"Upgrade gpustack to 2.2.2 (pip install -U 'gpustack>=2.2.2'). 2.2.2 validates SAML responses with OneLogin_Saml2_Auth.process_response() and only enables SAML/OIDC routes when that provider is the configured active one. No configuration workaround exists (not configuring SAML does not help); until upgraded, block network access to /auth/saml/callback at a reverse proxy or ingress.","status":"open","published_at":"2026-11-04T22:17:44+00:00","first_seen_at":"2026-11-04T23:08:47+00:00","triaged_at":"2026-11-04T23:09:43+00:00","updated_at":"2026-11-04T23:10:33+00:00","category":"ai-tooling","confidence":0.9,"triage":{"at":"2026-11-04T23:09:43Z","model":"claude-haiku-5-5","output":{"fix":"- GPUStack: upgrade to `2.2.2`.","reach":"internet","title":"GPUStack: unsigned SAML login lets anyone impersonate administrators","impact":"high","summary":"GPUStack, a GPU cluster manager for serving AI models, accepted SAML login responses without checking their signature, issuer, audience or timing. An attacker can submit any identity, including an administrator's, and receive a valid session token, even when SAML is not configured.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["gpustack","self-hosted","ai-models","gpu"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Attacker logs in as an administrator and takes over the GPU cluster","analyst_note":"Confirm the exact affected range and whether the fix is only in 2.2.2 via the linked GitHub patch and advisory pages.","how_to_check":"- Check the installed GPUStack version; affected versions are `0.7.1` through `2.2.1`.\n- Look for the `/auth/saml/callback` endpoint on your GPUStack server and whether it is reachable from the internet.","plain_action":"","needs_analyst":true,"not_affected_if":["version-2.2.2-or-later"],"who_is_affected":"Any GPUStack deployment from 0.7.1 up to but not including 2.2.2 is exposed, because the SAML callback is reachable whether or not SAML is configured. Servers reachable from untrusted networks are the main concern; servers only reachable on a locked-down internal network carry less risk but should still be upgraded.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000739,"input_tokens":4418,"output_tokens":594,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the exact affected range and whether the fix is only in 2.2.2 via the linked GitHub patch and advisory pages.","search":"'-102894':11A,14A '-2026':10A,13A '/auth/saml/callback':92C '0.7.1':88C '2.2.2':90C,177C 'accept':36B 'account':149C 'administr':8A,56B,141C,148C 'ai':17B,20B,34B,80C 'ai-model':16B 'ai-tool':19B 'also':168C 'anyon':6A 'assert':158C 'attack':49B 'attribut':101C 'audienc':45B,123C 'call':115C 'captur':164C 'check':41B 'client':130C 'cluster':30B,77C 'condit':127C 'configur':69B,155C 'consum':162C 'could':131C,167C 'cve':9A,12A 'decod':94C 'destin':124C 'endpoint':93C 'even':64B,150C 'exist':137C 'fix':174C 'gpu':22B,29B,76C,84C 'gpustack':1A,15A,23B,27B,70C,111C 'host':26B 'ident':53B,134C 'identifi':159C 'imperson':7A 'includ':54B,139C 'instanc':85C 'issu':172C 'issuer':44B,122C 'jwt':113C 'let':5A 'login':4A,38B 'manag':31B,78C 'mint':109C 'model':18B,35B,81C 'nameid':99C 'network':129C 'new':145C 'non':147C 'non-administr':146C 'onelogin_saml2_auth.process':116C 'open':74C 'open-sourc':73C 'provis':86C,105C,143C 'receiv':59B 'replay':170C 'resolv':103C 'respons':39B,117C,156C,166C 'saml':3A,37B,66B,95C,152C 'self':25B 'self-host':24B 'serv':33B,82C 'session':62B,112C 'sign':165C 'signatur':43B,121C 'sourc':75C 'submit':51B,132C 'time':47B,126C 'token':63B 'tool':21B 'unsign':2A 'use':97C 'user':107C,138C 'valid':61B 'verifi':119C 'version':176C 'without':40B,114C 'xml':96C","nicknames":[],"mitigations":[],"who_affected":"Every GPUStack deployment from 0.7.1 up to but not including 2.2.2 is exposed, because the SAML callback runs whether or not SAML is configured. Anyone who can reach /auth/saml/callback over the network, with no credentials, can get a session as any existing user, including an administrator, or create a new non-admin user. Self-hosted GPU/AI serving clusters reachable from untrusted networks are the main concern; 2.2.2 and later can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-04T23:10:33Z","by":"analyst","doc":"https://github.com/gpustack/gpustack/commit/705edbe1b5feec63959306daecd640e1c70eced2","run_id":1727},"products":{"at":"2026-11-04T23:10:33Z","by":"analyst","doc":"https://github.com/gpustack/gpustack/commit/705edbe1b5feec63959306daecd640e1c70eced2","run_id":1727},"how_to_check":{"at":"2026-11-04T23:10:33Z","by":"analyst","doc":"https://github.com/gpustack/gpustack/commit/705edbe1b5feec63959306daecd640e1c70eced2","run_id":1727},"who_affected":{"at":"2026-11-04T23:10:33Z","by":"analyst","doc":"https://github.com/gpustack/gpustack/commit/705edbe1b5feec63959306daecd640e1c70eced2","run_id":1727}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["gpustack"],"ptokens":["gpustack"],"labels":["aimodels","aitooling","critical","gpu","gpustack","selfhosted"],"campaign_type":null,"first_public_at":"2026-09-30T01:27:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102894","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102894","severity":null,"published_at":"2026-11-04T22:17:44+00:00","modified_at":"2026-11-04T22:17:44+00:00","first_seen_at":"2026-11-04T23:08:47+00:00","fetched_at":"2026-11-04T23:08:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-102894:1727","url":null,"severity":null,"published_at":"2026-11-04T23:10:33+00:00","modified_at":"2026-11-04T23:10:33+00:00","first_seen_at":"2026-11-04T23:10:33+00:00","fetched_at":"2026-11-04T23:10:33+00:00","note":"Read vendor GHSA-62m9-f875-rqw6: affected >= 0.7.1, < 2.2.2 (pip gpustack), fixed 2.2.2; every deployment affected, SAML config not required; interim workaround is blocking /auth/saml/callback at proxy. No public PoC (private to maintainers); no exploitation reported."}],"documents":[{"id":71114,"url":"https://github.com/gpustack/gpustack/commit/705edbe1b5feec63959306daecd640e1c70eced2","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71115,"url":"https://github.com/gpustack/gpustack/commit/adc6d82be34e48390720a1361df616e2ea9d6d45","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71116,"url":"https://github.com/gpustack/gpustack/releases/tag/v2.2.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71117,"url":"https://github.com/gpustack/gpustack/security/advisories/GHSA-62m9-f875-rqw6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-30T01:27:48+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}