Disclosed weakness · no CVE recorded

GPUStack could execute repository code while inspecting a model

GPUStack · GPUStack

First documented disclosure · Review checkpoint

Summary

Submitting a model for inspection could cause GPUStack to run code from the model repository with the server’s permissions.

Severity and exploitation evidence

Critical · 9.1/10 · CVSS 3.1. Severity source.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Model metadata inspection could run repository-supplied code with the inference management server’s privileges.

Conditions required

A user can submit a model for evaluation or deployment and influence its repository content. Required platform roles vary by version.

Potential impact

Data and credentials available to the GPUStack server could be exposed; service state or availability could change.

Affected versions and configurations

>= 2.0.0, < 2.3.1

Fix and mitigation status

2.3.1 fixes this issue.

Practical next steps

Upgrade to 2.3.1 or a later release containing this fix. Restrict model submission to trusted operators and review model sources. Use the patched server even for metadata inspection.

Operating lesson

Inspect model configuration as data before granting any model code permission to run.

Evidence and limits

The maintainer assigns the score. No CVE was listed in the original advisory at review.

Sources