---
id: "CVE-2026-102894"
kind: "vulnerability"
aliases: ["CVE-2026-102894"]
title: "GPUStack: unsigned SAML login lets anyone impersonate administrators"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "gpustack", "fixed": ["2.2.2"], "affected": ">= 0.7.1, < 2.2.2", "ecosystem": "pip"}]
ecosystems: []
tags: ["ai-models", "ai-tooling", "gpu", "gpustack", "self-hosted"]
not_affected_if: ["network-restricted", "version-2.2.2-or-later"]
published_at: "2026-11-04T22:17:44+00:00"
first_seen_at: "2026-11-04T23:08:47+00:00"
updated_at: "2026-11-04T23:10:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102894", "first_seen_at": "2026-11-04T23:08:47+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T23:10:33+00:00"}]
exploit_sources: []
---

# GPUStack: unsigned SAML login lets anyone impersonate administrators

GPUStack, a GPU cluster manager for serving AI models, accepted SAML login responses without checking their signature, issuer, audience or timing. An attacker can submit any identity, including an administrator's, and receive a valid session token, even when SAML is not configured.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pip:gpustack affected >= 0.7.1, < 2.2.2 fixed 2.2.2

## How to check

Run 'pip show gpustack' (or check the GPUStack version in the UI); any version >= 0.7.1 and < 2.2.2 is vulnerable, whether or not SAML is configured. Also check whether /auth/saml/callback is reachable from untrusted networks. If exposed, review admin logins and newly created users for unexpected accounts.

## Fix

Upgrade gpustack to 2.2.2 (pip install -U 'gpustack>=2.2.2'). 2.2.2 validates SAML responses with OneLogin_Saml2_Auth.process_response() and only enables SAML/OIDC routes when that provider is the configured active one. No configuration workaround exists (not configuring SAML does not help); until upgraded, block network access to /auth/saml/callback at a reverse proxy or ingress.

## Timeline

- 2026-11-04T23:08:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102894
- 2026-11-04T23:10:33+00:00 analyst — Read vendor GHSA-62m9-f875-rqw6: affected >= 0.7.1, < 2.2.2 (pip gpustack), fixed 2.2.2; every deployment affected, SAML config not required; interim workaround is blocking /auth/saml/callback at proxy. No public PoC (private to maintainers); no exploitation reported.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/gpustack/gpustack/security/advisories/GHSA-62m9-f875-rqw6
- [fix] Patch: github.com https://github.com/gpustack/gpustack/commit/705edbe1b5feec63959306daecd640e1c70eced2
- [fix] Patch: github.com https://github.com/gpustack/gpustack/commit/adc6d82be34e48390720a1361df616e2ea9d6d45
- [fix] Release notes: github.com https://github.com/gpustack/gpustack/releases/tag/v2.2.2

## From the sources

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_