Disclosed weakness · no CVE recorded

GPUStack service credentials could exceed their cluster scope

GPUStack · GPUStack

First documented disclosure · Review checkpoint

Summary

A service identity for one cluster could act on management resources outside its assigned scope.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Runtime service identities were trusted for management operations beyond their assigned cluster and role.

Conditions required

A caller has a valid cluster registration or worker service credential and access to the management API.

Potential impact

Affected management data and infrastructure settings could be accessed or changed outside the intended scope.

Affected versions and configurations

>= 2.2.0, < 2.3.1

Fix and mitigation status

2.3.1 fixes this issue.

Practical next steps

Upgrade to 2.3.1 or a later release containing this fix. Review registration tokens, management changes and workloads launched from unexpected configurations.

Operating lesson

Bind every service identity to its cluster and permitted operations.

Evidence and limits

The maintainer assigns the score. No CVE was listed in the original advisory at review.

Sources