---
id: "CVE-2026-103002"
kind: "vulnerability"
aliases: ["CVE-2026-103002"]
title: "GPUStack: authenticated users can reach Kubernetes clusters with worker credentials"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "gpustack", "fixed": ["2.2.2"], "affected": ">=2.2.0, <2.2.2", "ecosystem": "pip"}]
ecosystems: []
tags: ["ai-serving", "ai-tooling", "gpustack", "kubernetes", "self-hosted"]
not_affected_if: ["no-kubernetes-provider", "no-reachable-worker", "non-kubernetes-provider", "version-below-2.2.0"]
published_at: "2026-11-04T22:17:44+00:00"
first_seen_at: "2026-11-04T23:08:47+00:00"
updated_at: "2026-11-04T23:10:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-103002", "first_seen_at": "2026-11-04T23:08:47+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T23:10:29+00:00"}]
exploit_sources: []
---

# GPUStack: authenticated users can reach Kubernetes clusters with worker credentials

GPUStack, an open-source GPU cluster manager for AI model serving, forwarded requests from any logged-in non-administrator to Kubernetes clusters without checking permissions. The proxy used a worker's ServiceAccount credentials, so an attacker can read sensitive resources, change or delete workloads, and possibly run code in the target cluster.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pip:gpustack affected >=2.2.0, <2.2.2 fixed 2.2.2

## How to check

Run 'pip show gpustack' (or check the version in the GPUStack UI/server). Exposed if version is >=2.2.0 and <2.2.2 AND you have a Kubernetes-provider cluster with a reachable worker. Also review the worker ServiceAccount's RBAC permissions, which bound the impact.

## Fix

Upgrade gpustack (pip) to 2.2.2

## Timeline

- 2026-11-04T23:08:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-103002
- 2026-11-04T23:10:29+00:00 analyst — Read GHSA-3hch-x692-6qj3: affected >=2.2.0,<2.2.2, fixed 2.2.2; needs Kubernetes-provider cluster with reachable worker. Vendor workaround: restrict instance access to trusted admins until upgrading. No exploitation/PoC seen; discussion not searched.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/gpustack/gpustack/security/advisories/GHSA-3hch-x692-6qj3
- [fix] Patch: github.com https://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe
- [fix] Patch: github.com https://github.com/gpustack/gpustack/commit/cdd67467e0f314609dc82216e142940d321abfed
- [fix] Release notes: github.com https://github.com/gpustack/gpustack/releases/tag/v2.2.2

## From the sources

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_