Authorization Bypass in GPUStack by Vendor GPUStack

CVE-2026-103002

What is CVE-2026-103002?

GPUStack, an open-source GPU cluster manager, experienced a security issue where authenticated non-administrator users could send requests to a Kubernetes cluster without a proper resource-level authorization check. This flaw allowed access to sensitive resources and the ability to alter workloads using a reachable worker's Kubernetes ServiceAccount. As a result, this could lead to unauthorized reading, creation, modification, or deletion of resources based on the ServiceAccount's permissions. The vulnerability was effectively patched in version 2.2.2. Users of affected versions are strongly recommended to update to this version to safeguard their clusters.

References