{"id":"CVE-2026-102895","kind":"vulnerability","aliases":["CVE-2026-102895"],"related":[],"title":"GPUStack: forged localhost header grants unauthenticated admin access and code execution","description":"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.","summary":"GPUStack, a GPU cluster manager for AI model serving, trusts requests that appear to come from localhost when force_auth_localhost is off, which is the default. A remote attacker can forge a loopback source using a reverse proxy peer or a spoofed X-GPUStack-Real-IP header, gaining administrator rights to change users and models, read worker and cloud secrets, and run code through the inference backend YAML endpoint.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-inference","ai-tooling","gpustack","reverse-proxy","self-hosted"],"not_affected_if":["force_auth_localhost-true","version-2.2.0-or-later"],"how_to_check":"- Check the GPUStack version with `gpustack --version`; versions below `2.2.0` are affected.\n- Check whether `force_auth_localhost` is set to true in the GPUStack configuration; the default is false, so unset means exposed.\n- Check whether GPUStack sits behind a reverse proxy on the same host, since that is the forged-peer path.","fix":"- GPUStack: upgrade to `2.2.0`.","status":"open","published_at":"2026-11-04T22:17:44+00:00","first_seen_at":"2026-11-04T23:08:47+00:00","triaged_at":"2026-11-04T23:09:39+00:00","updated_at":"2026-11-04T23:09:39+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-04T23:09:39Z","model":"claude-haiku-5-5","output":{"fix":"- GPUStack: upgrade to `2.2.0`.","reach":"network","title":"GPUStack: forged localhost header grants unauthenticated admin access and code execution","impact":"high","summary":"GPUStack, a GPU cluster manager for AI model serving, trusts requests that appear to come from localhost when force_auth_localhost is off, which is the default. A remote attacker can forge a loopback source using a reverse proxy peer or a spoofed X-GPUStack-Real-IP header, gaining administrator rights to change users and models, read worker and cloud secrets, and run code through the inference backend YAML endpoint.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["gpustack","ai-inference","self-hosted","reverse-proxy"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Remote attacker gains admin, reads secrets, runs code on the server","analyst_note":"Confirm the exact default of force_auth_localhost and whether 2.2.0 is the only fixed release, using the vendor advisory linked in the sources.","how_to_check":"- Check the GPUStack version with `gpustack --version`; versions below `2.2.0` are affected.\n- Check whether `force_auth_localhost` is set to true in the GPUStack configuration; the default is false, so unset means exposed.\n- Check whether GPUStack sits behind a reverse proxy on the same host, since that is the forged-peer path.","plain_action":"","needs_analyst":true,"not_affected_if":["force_auth_localhost-true","version-2.2.0-or-later"],"who_is_affected":"Any deployment of GPUStack before 2.2.0 that is reachable from a network the attacker can reach, particularly where a same-host reverse proxy forwards traffic and force_auth_localhost was left at its default of false. Deployments that only accept connections from trusted local clients, or that set force_auth_localhost to true, are less exposed. The sources say exploitation was observed against a 2.1.1 deployment.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000816,"input_tokens":4447,"output_tokens":743,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-102895':14A,17A '-2026':13A,16A '/v2/inference-backends/from-yaml':211C '127.0.0.1':156C '2.1.1':220C '2.2.0':121C,228C 'accept':161C 'access':8A,186C 'admin':7A 'administr':81B,137C,185C,193C 'ai':19B,22B,37B,112C 'ai-infer':18B 'ai-tool':21B 'allow':183C 'api':195C 'api-key':194C 'appear':43B,152C 'attack':60B 'auth':50B,140C 'backend':99B 'built':135C 'built-in':134C 'bypass':182C 'chang':84B,191C 'client':158C,172C 'client-suppli':171C 'cloud':91B,203C 'cloud-provid':202C 'cluster':34B,109C 'code':10A,95B,207C 'come':45B 'could':151C 'creation':197C 'current':123C 'cve':12A,15A 'default':57B,147C 'deploy':221C 'disclosur':198C 'endpoint':101B 'execut':11A,208C 'exploit':212C 'fals':143C 'fix':225C 'forc':49B,139C 'forg':2A,62B 'gain':80B 'get':122C 'getter':160C 'gpu':33B,108C,116C 'gpustack':1A,24B,31B,76B,102C,176C 'gpustack/api/auth.py':126C 'grant':5A 'header':4A,79B 'host':30B,165C 'includ':187C 'infer':20B,98B 'instanc':117C 'ip':78B,159C,178C 'issu':223C 'key':196C 'localhost':3A,47B,51B,141C 'loopback':64B,129C,179C 'manag':35B,110C 'model':38B,87B,113C,190C 'observ':214C 'open':106C 'open-sourc':105C 'origin':154C 'peer':70B,168C 'persist':192C 'post':210C 'prior':119C 'provid':204C 'provis':118C 'proxi':27B,69B,167C 'read':88B 'real':77B,177C 'remot':59B,149C 'request':41B,130C,150C 'revers':26B,68B,166C 'reverse-proxi':25B 'right':82B 'run':94B 'same-host':163C 'secret':92B,205C 'self':29B 'self-host':28B 'serv':39B,114C 'sourc':65B,107C,131C 'spoof':73B 'suppli':173C 'tool':23B 'treat':127C 'trust':40B 'unauthent':6A,184C 'use':66B 'user':85B,124C,188C 'valu':180C 'version':227C 'wild':217C 'worker':89B,200C 'x':75B,175C 'x-gpustack-real-ip':74B,174C 'yaml':100B","nicknames":[],"mitigations":[],"who_affected":"Any deployment of GPUStack before 2.2.0 that is reachable from a network the attacker can reach, particularly where a same-host reverse proxy forwards traffic and force_auth_localhost was left at its default of false. Deployments that only accept connections from trusted local clients, or that set force_auth_localhost to true, are less exposed. The sources say exploitation was observed against a 2.1.1 deployment.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiinference","aitooling","critical","gpustack","reverseproxy","selfhosted"],"campaign_type":null,"first_public_at":"2026-07-31T11:58:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102895","severity":null,"published_at":"2026-11-04T22:17:44+00:00","modified_at":"2026-11-04T22:17:44+00:00","first_seen_at":"2026-11-04T23:08:47+00:00","fetched_at":"2026-11-04T23:08:47+00:00","note":null}],"documents":[{"id":71118,"url":"https://github.com/gpustack/gpustack/commit/53f42a6a553542974396d16a4ff6b12bcbedb48d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71119,"url":"https://github.com/gpustack/gpustack/releases/tag/v2.2.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71120,"url":"https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-31T11:58:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}