Disclosed weakness · no CVE recorded

GPUStack could attach a model instance to another tenant’s model

GPUStack · GPUStack

First documented disclosure · Review checkpoint

Summary

An organization owner could attach an instance to another tenant’s model and interfere with how GPUStack treated its replicas.

Severity and exploitation evidence

Medium · 6.4/10 · CVSS 3.1. Severity source.

Exploitation not established: The original source establishes the weakness but does not report malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Model-instance creation did not establish the organization owner’s access to the named parent model.

Conditions required

An organization owner can use model-instance creation and identify another organization’s model.

Potential impact

Unexpected instances could interfere with inference routing, readiness or replica counts.

Affected versions and configurations

2.2.0 and later, before 2.3.1 (maintainer narrative).

Fix and mitigation status

2.3.1 fixes this issue.

Practical next steps

Upgrade to 2.3.1 or a later release containing this fix. Review unrecognized instances and their model, owner and cluster associations.

Operating lesson

Derive a child resource’s tenant and cluster from its authorized parent.

Evidence and limits

The maintainer assigns the score. No CVE was listed in the original advisory at review. The affected range follows the maintainer’s narrative. Its package table gives a different range, and both identify 2.3.1 as fixed.

Sources