CVE-2026-102894

GPUStack accepted forged SAML sign-ins without checking the assertion

GPUStack · GPUStack SAML callback

First documented disclosure · Review checkpoint

Summary

Someone who could reach the callback could impersonate an existing account, including an administrator.

Severity and exploitation evidence

Critical · 9.1/10 · CVSS 3.1. Severity source.

Exploitation not established: GPUStack describes a privately supplied proof of concept. Its advisory does not identify malicious exploitation of this SAML issue.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The callback extracted identity data directly from XML and issued a session before checking the assertion signature, issuer, audience or expiration. The route remained available with SAML disabled.

Conditions required

Network access to the callback. Impersonating a particular account requires supplying an identity that matches it.

Potential impact

The caller can take over an existing identity or provision a new non-administrator account under a new name. Administrator access gives control over the GPU deployment.

Affected versions and configurations

0.7.1 through 2.2.1, inclusive.

Fix and mitigation status

2.2.2 validates assertions and gates SSO routes on the active provider. It still allows a captured, valid signed response to be reused within its validity window.

Practical next steps

Upgrade, keep signing checks enabled, use short-lived assertions and review unexpected sessions. Until patched, block the callback at ingress even when SAML is disabled.

Operating lesson

Verify a signed identity assertion and its validity conditions before issuing an application session.

Evidence and limits

The July 1 public change specifically describes the forgery. A second July fix gated disabled SSO routes. The July 24 release predates the September advisory and November 4 CNA. Disabling both signing requirements defeats signature protection.

Sources