Disclosed weakness · no CVE recorded

GPUStack runtime metrics settings lacked an administrator check

GPUStack · GPUStack

First documented disclosure · Review checkpoint

Summary

An ordinary account could change the metrics used to monitor inference across the deployment, affecting dashboards and alerts.

Severity and exploitation evidence

Medium · 5.4/10 · CVSS 3.1. Severity source.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

An authenticated user could change deployment-wide metrics settings without a platform administrator role.

Conditions required

The user is authenticated and can reach the service.

Potential impact

Missing or incorrect inference metrics could impair dashboards and alerts.

Affected versions and configurations

>= 2.0.0, < 2.3.1

Fix and mitigation status

2.3.1 fixes this issue.

Practical next steps

Upgrade to 2.3.1 or a later release containing this fix. Review the runtime metrics mappings against a trusted baseline.

Operating lesson

Protect monitoring configuration as strictly as the services it monitors.

Evidence and limits

The maintainer assigns the score. No CVE was listed in the original advisory at review.

Sources