Disclosed weakness · no CVE recorded

GPUStack model proxy could use a server token outside the user’s permissions

GPUStack · GPUStack

First documented disclosure · Review checkpoint

Summary

A low-privilege user could reach Hugging Face resources using permissions granted to the GPUStack server.

Severity and exploitation evidence

Medium · 6.4/10 · CVSS 3.1. Severity source.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The model proxy did not adequately restrict which operations could use the server’s Hugging Face token.

Conditions required

A low-privilege account can use the model proxy on an instance with a server token configured.

Potential impact

Users could access resources permitted to the server token. Modifications depend on the token’s upstream permissions.

Affected versions and configurations

<= 2.3.0

Fix and mitigation status

2.3.1 fixes this issue.

Practical next steps

Upgrade to 2.3.1 or a later release containing this fix. Scope the server token narrowly and audit its prior use.

Operating lesson

Enforce the caller’s permissions wherever a proxy uses a broader service credential.

Evidence and limits

The maintainer assigns the score. No CVE was listed in the original advisory at review.

Sources