CVE-2026-102895

GPUStack loopback trust gave remote callers administrator access

GPUStack · GPUStack control plane

First documented disclosure · Review checkpoint

Summary

GPUStack reports that attackers used this bypass on a 2.1.1 deployment and created inference backends that ran reverse shells.

Severity and exploitation evidence

Critical · 9.8/10 · CVSS 3.1. Severity source.

Reported activity: GPUStack reports attacker-created backends running reverse shells on a 2.1.1 deployment. The report is separate from the researchers’ controlled bypass tests.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The control plane treated loopback as proof of administrator identity. It could derive that address from a same-host proxy connection or from an untrusted real-IP header.

Conditions required

The control plane is reachable, the default loopback shortcut is enabled, and the request arrives through a same-host proxy or can supply a trusted loopback value.

Potential impact

An unauthenticated caller can obtain administrator powers, create persistent API keys, access worker or cloud credentials and run code on workers through a custom backend.

Affected versions and configurations

Versions before 2.2.0. The maintainer identifies 2.1.1 in the observed exploitation.

Fix and mitigation status

2.2.0 removes implicit loopback administrator access.

Practical next steps

Upgrade to a supported release containing the fix. Review custom backends and administrator keys, investigate worker activity and rotate credentials reachable from the control plane. Pending upgrade, enable force_auth_localhost and restrict network access.

Operating lesson

Authenticate every privileged request independently of its apparent network source.

Evidence and limits

The May 19 public change predates the July 31 maintainer advisory and November 4 CVE record. GPUStack documents an exploited deployment. The sources do not establish prevalence or a final victim recovery.

Sources