Disclosed weakness · no CVE recorded

GPUStack worker registration could cross cluster boundaries

GPUStack · GPUStack

First documented disclosure · Review checkpoint

Summary

A worker-registration credential for one cluster could introduce or alter registrations in another.

Severity and exploitation evidence

High · 8.8/10 · CVSS 3.1. Severity source.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Registration checked the service identity type but not its relationship to the destination cluster.

Conditions required

The caller holds a valid worker registration credential and can reach the management API.

Potential impact

Worker registrations could be introduced or altered outside their assigned cluster.

Affected versions and configurations

>=2.2.0, <2.3.0

Fix and mitigation status

2.3.0 fixes this issue.

Practical next steps

Upgrade to 2.3.0 or a later release containing this fix. Review registered worker identities and rotate registration credentials that might have been misused.

Operating lesson

Test registration against a different cluster as well as the intended cluster.

Evidence and limits

GPUStack shipped 2.3.0 on October 23. GitHub records an edit to the release notes on October 26, when GPUStack published the dated advisory. No CVE was listed in the advisory at review.

Sources