External risk intelligence

GPUStack Authentication Bypass Allows Remote Administrative Access and Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-102895

GPUStack is a GPU cluster manager designed for AI model serving and instance provisioning, which are services commonly exposed as web-accessible APIs or management interfaces to facilitate remote deployment and model inference.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in GPUStack, an open-source tool for managing GPU clusters used in AI, could allow unauthorized remote access to administrative functions. This could potentially lead to changes in user and model configurations, the creation of persistent API keys, exposure of sensitive secrets, and even code execution. The issue has been observed in active deployments and is addressed in version 2.2.0.

Unauthenticated remote administrative control.
Protects sensitive AI infrastructure and data.
Confirm if GPUStack is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted remote request to a vulnerable GPUStack deployment. By manipulating the request to appear as a local loopback, the attacker could bypass authentication checks and gain administrative privileges, leading to unauthorized changes, secret disclosure, or even code execution.

Unauthenticated remote access required.
Triggered by a crafted loopback request.
Risk of unauthorized admin access and code execution.

Live Threat

Current exploitation, exposure, and threat context

In certain configurations, remote attackers could bypass authentication in GPUStack, an open-source GPU cluster manager. This bypass could allow them to gain administrative access, enabling them to alter users and models, create persistent API keys, view sensitive secrets, and potentially execute code.

Administrative access and sensitive secrets.
Unauthenticated remote requests bypassed authentication.
Unauthorized control and potential code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The GPU cluster manager for AI models and GPU instances is likely managed by a platform or infrastructure team, with oversight from a security team for external access controls. The immediate priority is to locate all GPUStack deployments, confirm their exposure and business criticality, and identify the accountable owner for remediation.

Platform/Infrastructure teams own this.
Verify external reachability and criticality.
Plan and coordinate urgent upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is GPUStack?

GPUStack is an open-source software platform designed for managing GPU clusters. It allows teams to provision GPU instances and serve AI models, acting as a centralized control plane for heavy computational resources used in machine learning workflows.

How does CVE-2026-102895 break authentication?

This vulnerability involves Improper Authentication and Spoofing. The software incorrectly trusts requests that appear to originate from the local machine (the loopback address). By manipulating request headers to mimic this 'local' source, an attacker can trick the system into granting them full administrative privileges without providing any valid login credentials.

When does this authentication bypass occur?

The issue occurs when the system is configured with the default setting where 'force_auth_localhost' is disabled. It is not triggered by standard, legitimate traffic from authenticated users. Instead, it requires a specially crafted remote request designed to trick the software into believing the connection came from its own host environment.

Is my GPUStack instance at risk?

Halo Surface Signal indicates that GPUStack deployments are frequently exposed as web-accessible APIs to support remote model inference. If your instance is reachable over a network, it is a primary candidate for this attack, as the vulnerability does not require physical or local system access to exploit.

How do I secure my environment against this?

The priority is to update all GPUStack installations to version 2.2.0 or higher. If you cannot update immediately, restrict network access to the management interface so it is not publicly reachable. Coordinate with your platform or infrastructure team to verify your current version and apply the patch as soon as possible.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.