Disclosed weakness · no CVE recorded

GPUStack could bind another organization’s cloud credential to a cluster

GPUStack · GPUStack

First documented disclosure · Review checkpoint

Summary

An organization owner could provision a cluster against a different organization’s cloud account using a credential held by GPUStack.

Severity and exploitation evidence

Medium · 6.4/10 · CVSS 3.1. Severity source.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Cluster creation did not verify the organization’s right to use the selected cloud credential.

Conditions required

An organization owner can create a cloud cluster and identify a credential belonging to another organization.

Potential impact

Provisioning could use another organization’s cloud account. This does not by itself disclose the raw credential.

Affected versions and configurations

>= 2.2.0, <= 2.3.0

Fix and mitigation status

2.3.1 fixes this issue.

Practical next steps

Upgrade to 2.3.1 or a later release containing this fix. Audit cluster-to-credential assignments and upstream provisioning charges.

Operating lesson

Check resource ownership before storing a cross-resource reference.

Evidence and limits

The maintainer assigns the score. No CVE was listed in the original advisory at review.

Sources