Remote Authentication Bypass Vulnerability in GPUStack by GPUStack

CVE-2026-102895

What is CVE-2026-102895?

The vulnerability in GPUStack, a GPU cluster manager, allows unauthenticated administrative access due to improper handling of loopback requests in the get_current_user function. When force_auth_localhost is set to false (the default), remote requests can be mistakenly treated as if they originate from the local host. This flaw enables attackers to gain admin privileges, modify user settings, create persistent API keys, and access sensitive information. It is critical for users of versions prior to 2.2.0 to upgrade immediately to mitigate these risks.

References