Disclosed weakness · no CVE recorded

GPUStack model-file requests could write on another cluster’s worker

GPUStack · GPUStack

First documented disclosure · Review checkpoint

Summary

An organization owner could direct a model-file write to a worker in a cluster outside their control.

Severity and exploitation evidence

High · 8.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Model-file creation did not verify the caller’s authority over the target worker’s cluster.

Conditions required

An authenticated organization owner can submit file operations processed by an affected worker.

Potential impact

A worker could write in an unauthorized cluster. Filesystem effects depend on the worker’s permissions.

Affected versions and configurations

>=2.2.0, <2.3.0

Fix and mitigation status

2.3.0 fixes this issue.

Practical next steps

Upgrade to 2.3.0 or a later release containing this fix. Audit pending downloads and unexpected file changes, and restrict worker filesystem permissions.

Operating lesson

Authorize the destination worker before accepting a file operation.

Evidence and limits

GPUStack shipped 2.3.0 on October 23. GitHub records an edit to the release notes on October 26, when GPUStack published the dated advisory. No CVE was listed in the advisory at review.

Sources