#GPUStack
LightNews LightNews
runbooklab.bsky.social
GPUStack CVE-2026-102895 is in CISA KEV since 9 Nov, due 12 Nov. Before 2.2.0 a remote request can get the built-in admin.
Do this: upgrade every GPUStack server to 2.2.0+, then review admin API keys.
Check: pip show gpustack
runbooklabhq.com/news/gpustac...
GPUStack CVE-2026-102895, in CISA KEV since 9 November 2026, due 12 November. GPUStack before 2.2.0 can give a remote request the built-in admin account. Do this: upgrade every GPUStack server to 2.2.0 or later, then review admin API keys. Source: GPUStack advisory GHSA-gj9m-f8ph-pmhr.
November 9, 2026 at 6:28 PM
vulnidx-jp.bsky.social
【悪用確認】CVE-2026-102895
GPUStack Improper Authentication Vulnerability
GPUStack
CISA 追加 11/9・対応期限 11/12
https://nvd.nist.gov/vuln/detail/CVE-2026-102895
#脆弱性 #KEV #GPUStack
November 9, 2026 at 5:55 PM
5. CVE-2026-102895 · 9 people 🔥
🟥 Critical 9.8 · gpustack

GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
November 9, 2026 at 7:15 PM
ninjaintelgroup.bsky.social
🚨 NEW on CISA KEV — exploited in the wild
GPUStack GPUStack: GPUStack Improper Authentication Vulnerability
CVE-2026-102895 · patch by 2026-11-12
🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-102895
#KEV #cybersecurity #infosec
November 9, 2026 at 9:15 PM
eventmonitor.bsky.social
CVE-2026-102895: GPUStack Improper Authentication Vulnerability
https://cyber.eventmonitor.net/incident/EM-20261109-OXT9/cve-2026-102895-gpustack-improper-authentication-vulnerability/
#news #cybersecurity
November 9, 2026 at 5:22 PM
cvesentinel.bsky.social
🚨 CVE-2026-102895
gpustack gpustack
CVSS 9.8 / EPSS 0.33% / KEV ✅
TL;DR: GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in…
https://cvesentinel.com/report/CVE-2026-102895
#infosec #CVE #vulnerability
November 9, 2026 at 8:23 PM
cvesentinel.bsky.social
🚨 CVE-2026-102895
gpustack gpustack
CVSS 9.8 / EPSS 0.33% / KEV ✅
TL;DR: GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in…
https://cvesentinel.com/report/CVE-2026-102895
#infosec #CVE #vulnerability
November 9, 2026 at 8:23 PM
chuiho.net
🚨速報［警戒］GPUStack CVE-2026-102895 悪用確認、CISA が KEV に追加
AI モデル運用基盤 GPUStack の 2.2.0 未満に、ログインなしで管理者になれる欠陥（CVE-2026-102895、CVSS 9.8）。実環境での悪用を受け CISA が KEV に追加。
https://chuiho.net/posts/gpustack-cve-2026-102895-kev-auth-bypass/ #GPUStack #CVE2026102895
GPUStack CVE-2026-102895 悪用確認、CISA が KEV に追加
AI モデル運用基盤 GPUStack の 2.2.0 未満に、ログインなしで管理者になれる欠陥（CVE-2026-102895、CVSS 9.8）。実環境での悪用を受け CISA が KEV に追加。
chuiho.net
November 9, 2026 at 6:10 PM
axnews.bsky.social
⚠️ Exploited in the wild: CVE-2026-102895
GPUStack Improper Authentication Vulnerability
Added to CISA KEV · Critical 9.8
Impacted if: gpustack < 2.2.0
https://ax-news.com/cve/CVE-2026-102895
#CVE #KEV #infosec
November 9, 2026 at 6:11 PM
infonewscyber.bsky.social
⚠️ FAILLE CRITIQUE

CVE-2026-102895 activement exploitée : authentification incorrecte dans GPUStack

🔗 https://infonewscyber.fr/info/cve-2026-102895-activement-exploitee-authentification-incorrecte-dans-a4fa5d886e281372
#GPUStack #ZeroDay #Cybersécurité
CVE-2026-102895 activement exploitée : authentification incorrecte dans GPUStack
GPUStack présente une vulnérabilité liée à une authentification incorrecte qui pourrait permettre un accès administratif sans authentification, notamment la modification des utilisateurs et des modèles, la création de clés API d'administrateur persistantes, la divulgation de secr
infonewscyber.fr
November 9, 2026 at 5:30 PM
malice.ai
The critical flaw (CVSS 9.8) allows unauthenticated administrative access and code execution; GPUStack 2.2.0 fixes it, and CISA set a November 12 due date.
CISA adds GPUStack authentication bypass CVE-2026-102895 to KEV catalog
malice.ai
November 9, 2026 at 5:02 PM
cyberhub.blog
📌 CVE-2026-102895 - GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/au... https://www.cyberhub.blog/cves/CVE-2026-102895
CVE-2026-102895
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request cou
www.cyberhub.blog
November 10, 2026 at 2:37 AM
patchsonar.com
Zero-day · Newly listed by CISA: GPUStack
GPUStack Improper Authentication Vulnerability

What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until…

https://patchsonar.com/cve/CVE-2026-102895 #ZeroDay #CyberSecurity
GPUStack: GPUStack Improper Authentication Vulnerability
Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
patchsonar.com
November 9, 2026 at 5:50 PM
threatroundup.bsky.social
CVE-2026-102895 (GPUStack) just landed on CISA's exploited list, CVSS 9.8. GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. No public exploit reported yet. #KEV #infosec

threatroundup.com/cve/cve-2026...
November 9, 2026 at 7:08 PM
cvesentinel.bsky.social
🛑 CVE-2026-102895
CVSS 9.8 / EPSS 0.33% / KEV ✅
TL;DR: GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a…
https://cvesentinel.com/report/CVE-2026-102895
#infosec #CVE #vulnerability
November 9, 2026 at 6:22 PM
unnchain.bsky.social
GPUStack（GPU上でAIモデルを配信する管理ツール）を使っている人へ。

CVE-2026-102895（CVSS 9.8）：同じサーバーのリバースプロキシ経由のアクセスを「ローカル」と見なし、ログインなしで管理者にしてしまう欠陥。悪用が確認され、CISAが11/9にKEVへ追加。

2.2.0で修正。SAMLの別欠陥CVE-2026-102894も直る2.2.2以降へ。管理者APIキーや保存した秘密情報も確認を。
https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr
November 10, 2026 at 3:46 AM
threadlinqs.bsky.social
CISA KEV adds four: GPUStack, FreeSWITCH, OpenSSH *sshole and Aspera. Auth bypass to RCE, patch now. https://intel.threadlinqs.com/threat/TL-2026-5587?utm_source=bluesky #ThreatIntel #CVE_2026_102895 #CVE_2026_116779 #sshole
November 9, 2026 at 9:27 PM
aisecguru.bsky.social
Critical GPUStack flaw (CVE-2026-102895, CVSS 9.8) is being exploited: spoofed loopback requests give unauthenticated admin on AI GPU clusters, leading to reverse shells and stolen cloud secrets. Upgrade to 2.2.0. https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr
Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
### Impact In GPUStack before v2.2.0, `get_current_user` (in `gpustack/api/auth.py`) promotes any request whose source is considered loopback to the built-in administrator account when `force_...
github.com
November 5, 2026 at 12:49 AM
euvd-bot.bsky.social
🚨 EUVD-2026-117177
📊 8.8/10
🏢 gpustack

📝 GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forw...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117177

#cybersecurity #infosec #cve #euvd
November 6, 2026 at 6:02 AM
stackflag.bsky.social
CVE-2026-102894 - gpustack
The GPUStack manager (versions 0.7.1 through 2.2.1) accepts SAML login data without checking its digital signature or other security checks. This means anyone could create or take over…

Too many irrelevant or confusing CVEs? Use stackflag.com

#gpustack #CVE #infosec
CVE-2026-102894: GPUStack allows unauthorized login via SAML callback
The GPUStack manager (versions 0.7.1 through 2.2.1) accepts SAML login data without checking its digital signature or other security checks.
stackflag.com
November 4, 2026 at 10:40 PM
cvesentinel.bsky.social
🚨 CVE-2026-102895
gpustack gpustack
CVSS 9.8 / EPSS 0.33% / KEV ✅
TL;DR: GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in…
https://cvesentinel.com/report/CVE-2026-102895
#infosec #CVE #vulnerability
November 9, 2026 at 9:23 PM
euvd-bot.bsky.social
🚨 EUVD-2026-117124
📊 9.8/10
🏢 gpustack

📝 GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/aut...

🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117124

#cybersecurity #infosec #cve #euvd
November 4, 2026 at 10:02 PM
stackflag.bsky.social
CVE-2026-102895 - gpustack
The open‑source gpustack service version before 2.2.0 treats requests that appear to come from the local computer as if they are from the built‑in administrator. Because the software can…

Too many irrelevant or confusing CVEs? Use stackflag.com

#gpustack #CVE #infosec
CVE-2026-102895: gpustack lets remote users obtain admin rights
The open‑source gpustack service version before 2.2.0 treats requests that appear to come from the local computer as if they are from the built‑in.
stackflag.com
November 4, 2026 at 10:20 PM
stemshop.bsky.social
🚨 CVE-2026-102895 — CVSS 9.8 CRITICAL

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to...

🔎 https://stemshop.top/cve/CVE-2026-102895

#CVE #CyberSecurity #InfoSec
November 5, 2026 at 12:07 AM
mariogalarza.bsky.social
CISA added 4 actively exploited flaws to KEV — 3 of them CVSS 9.8 — with a 3-day patch deadline: Nov 12. GPUStack, FreeSWITCH, OpenSSH, IBM Faspex. Patch now, then hunt for prior compromise. https://www.linkedin.com/feed/update/urn:li:share:7525704313101303809/
November 9, 2026 at 11:42 PM