Disclosed weakness · no CVE recorded

GPUStack resource updates could change ownership

GPUStack · GPUStack

First documented disclosure · Review checkpoint

Summary

A user who could edit a resource could change who owned it, including making a workload template available to other tenants.

Severity and exploitation evidence

Critical · 9.0/10 · CVSS 3.1. Severity source.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Ordinary updates did not preserve resource ownership.

Conditions required

A signed-in user can update an affected resource.

Potential impact

Resources could appear in another scope, including global templates. Workload effects depend on another user selecting the template.

Affected versions and configurations

2.2.0 and later, before 2.3.1 (maintainer narrative).

Fix and mitigation status

2.3.1 fixes this issue.

Practical next steps

Upgrade to 2.3.1 or a later release containing this fix. Review global templates and ownership assignments, including items created before patching.

Operating lesson

Check authorization for changes of ownership separately from ordinary edits.

Evidence and limits

The maintainer assigns the score. No CVE was listed in the original advisory at review. The affected range follows the maintainer’s narrative. Its package table gives a different range, and both identify 2.3.1 as fixed.

Sources