{"id":"CVE-2026-103002","kind":"vulnerability","aliases":["CVE-2026-103002"],"related":[],"title":"GPUStack: authenticated users can reach Kubernetes clusters with worker credentials","description":"GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2.","summary":"GPUStack, an open-source GPU cluster manager for AI model serving, forwarded requests from any logged-in non-administrator to Kubernetes clusters without checking permissions. The proxy used a worker's ServiceAccount credentials, so an attacker can read sensitive resources, change or delete workloads, and possibly run code in the target cluster.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gpustack","fixed":["2.2.2"],"affected":">=2.2.0, <2.2.2","ecosystem":"pip"}],"ecosystems":[],"tags":["ai-serving","ai-tooling","gpustack","kubernetes","self-hosted"],"not_affected_if":["no-kubernetes-provider","no-reachable-worker","non-kubernetes-provider","version-below-2.2.0"],"how_to_check":"Run 'pip show gpustack' (or check the version in the GPUStack UI/server). Exposed if version is >=2.2.0 and <2.2.2 AND you have a Kubernetes-provider cluster with a reachable worker. Also review the worker ServiceAccount's RBAC permissions, which bound the impact.","fix":"Upgrade gpustack (pip) to 2.2.2","status":"open","published_at":"2026-11-04T22:17:44+00:00","first_seen_at":"2026-11-04T23:08:47+00:00","triaged_at":"2026-11-04T23:09:44+00:00","updated_at":"2026-11-04T23:10:29+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-04T23:09:44Z","model":"claude-haiku-5-5","output":{"fix":"- GPUStack: upgrade to `2.2.2`","reach":"network","title":"GPUStack: authenticated users can reach Kubernetes clusters with worker credentials","impact":"high","summary":"GPUStack, an open-source GPU cluster manager for AI model serving, forwarded requests from any logged-in non-administrator to Kubernetes clusters without checking permissions. The proxy used a worker's ServiceAccount credentials, so an attacker can read sensitive resources, change or delete workloads, and possibly run code in the target cluster.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["gpustack","kubernetes","self-hosted","ai-serving"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker reads secrets, changes workloads, and may run code in cluster","analyst_note":"Confirm the affected version range and fix from the vendor advisory and patch links, since the sources here do not name exact product ranges beyond the description.","how_to_check":"- Check the GPUStack version: `gpustack --version` should report a release below `2.2.2` if you are affected.\n- Check whether any cluster uses the Kubernetes provider with a reachable worker in the GPUStack admin console.\n- Confirm the installed version falls in the range `2.2.0` through `2.2.1`.","plain_action":"","needs_analyst":true,"not_affected_if":["non-kubernetes-provider","no-reachable-worker"],"who_is_affected":"Affected are GPUStack deployments from 2.2.0 up to but not including 2.2.2 that manage Kubernetes-provider clusters with reachable workers. Exposure depends on the ServiceAccount permissions the worker holds, and any logged-in user, not only administrators, can reach the proxy. Deployments without Kubernetes-provider clusters or with no reachable workers are not exploitable through this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000792,"input_tokens":4417,"output_tokens":701,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the affected version range and fix from the vendor advisory and patch links, since the sources here do not name exact product ranges beyond the description.","search":"'-103002':13A,16A '-2026':12A,15A '2.2.0':102C '2.2.2':104C,189C 'accord':152C 'administr':50B,113C 'ai':19B,22B,38B,94C 'ai-serv':18B 'ai-tool':21B 'apiserv':106C 'attack':67B,171C 'attacker-control':170C 'authent':2A,110C 'author':126C 'caller':140C 'chang':72B 'check':55B,127C 'cluster':7A,35B,53B,83B,91C,105C,120C,164C,182C 'code':79B,177C 'control':172C 'could':141C,174C 'creat':145C 'credenti':10A,64B,137C 'cve':11A,14A 'delet':74B,150C 'execut':178C 'exploit':158C 'fix':186C 'forward':41B,108C 'gpu':34B,90C,98C 'gpustack':1A,17A,24B,29B,84C 'host':28B 'instanc':99C 'issu':184C 'kubernet':6A,25B,52B,119C,135C,162C 'kubernetes-provid':161C 'level':125C 'log':46B 'logged-in':45B 'manag':36B,92C 'model':39B,95C 'modifi':147C 'non':49B,112C 'non-administr':48B,111C 'open':32B,88C 'open-sourc':31B,87C 'permiss':56B,157C 'possibl':77B 'provid':163C 'provis':100C 'proxi':58B,107C,129C 'reach':5A 'reachabl':132C,167C 'read':69B,142C 'request':42B,115C 'requir':159C 'resourc':71B,124C,144C,151C 'resource-level':123C 'result':175C 'run':78B 'select':118C 'self':27B 'self-host':26B 'sensit':70B,143C 'serv':20B,40B,96C 'serviceaccount':63B,136C,155C 'sourc':33B,89C 'target':82B,181C 'tool':23B 'use':59B,130C 'user':3A 'version':188C 'without':54B,121C 'worker':9A,61B,133C,168C 'workload':75B,148C,173C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted GPUStack servers running 2.2.0 or 2.2.1 that manage a Kubernetes-provider cluster with a reachable worker. Any logged-in non-admin user can send requests through the Kubernetes API proxy using the worker's ServiceAccount permissions, so impact depends on that ServiceAccount's RBAC. Deployments with no Kubernetes-provider clusters, or only trusted admin users, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-04T23:10:29Z","by":"analyst","doc":"https://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe","run_id":1728},"products":{"at":"2026-11-04T23:10:29Z","by":"analyst","doc":"https://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe","run_id":1728},"how_to_check":{"at":"2026-11-04T23:10:29Z","by":"analyst","doc":"https://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe","run_id":1728},"who_affected":{"at":"2026-11-04T23:10:29Z","by":"analyst","doc":"https://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe","run_id":1728}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["gpustack"],"ptokens":["gpustack"],"labels":["aiserving","aitooling","gpustack","high","kubernetes","selfhosted"],"campaign_type":null,"first_public_at":"2026-10-01T00:20:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103002","severity":null,"published_at":"2026-11-04T22:17:44+00:00","modified_at":"2026-11-04T22:17:44+00:00","first_seen_at":"2026-11-04T23:08:47+00:00","fetched_at":"2026-11-04T23:08:47+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-103002:1728","url":null,"severity":null,"published_at":"2026-11-04T23:10:29+00:00","modified_at":"2026-11-04T23:10:29+00:00","first_seen_at":"2026-11-04T23:10:29+00:00","fetched_at":"2026-11-04T23:10:29+00:00","note":"Read GHSA-3hch-x692-6qj3: affected >=2.2.0,<2.2.2, fixed 2.2.2; needs Kubernetes-provider cluster with reachable worker. Vendor workaround: restrict instance access to trusted admins until upgrading. No exploitation/PoC seen; discussion not searched."}],"documents":[{"id":71121,"url":"https://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71122,"url":"https://github.com/gpustack/gpustack/commit/cdd67467e0f314609dc82216e142940d321abfed","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71116,"url":"https://github.com/gpustack/gpustack/releases/tag/v2.2.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":71124,"url":"https://github.com/gpustack/gpustack/security/advisories/GHSA-3hch-x692-6qj3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-01T00:20:02+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}