Organisations running GPUStack have until the end of today, Thursday 12 November 2026, to patch a critical authentication bypass that attackers are already exploiting. The flaw, tracked as CVE-2026-102895, carries a CVSS score of 9.8 and lets an unauthenticated attacker become an administrator of a GPUStack server — no password, no account, no login required.

CISA, the US Cybersecurity and Infrastructure Security Agency, added the flaw to its Known Exploited Vulnerabilities catalogue on 9 November after confirming it is being exploited in the wild. Under CISA's Binding Operational Directive 26-04, US federal civilian agencies must patch or mitigate it by today. The deadline is legally binding only on those agencies, but the risk is the same for every other organisation running the software, and security teams are treating today as a same-day patching priority.

How the bypass works

GPUStack is an open-source GPU cluster manager used to run AI inference workloads — the self-hosted stack teams use to serve large language models and other AI models from their own hardware or cloud instances, often through OpenAI-compatible APIs. A GPUStack server typically holds API keys, worker credentials and cloud-provider secrets, and can push configuration to every worker node it controls.

The flaw is in the way GPUStack decides who is an administrator. In versions before 2.2.0, the get_current_user function in gpustack/api/auth.py automatically grants built-in administrator rights to any request it considers to come from the server itself — from the loopback address 127.0.0.1 — when a setting called force_auth_localhost is left at its default value of false.

GPUStack's own security advisory, GHSA-gj9m-f8ph-pmhr, says a remote attacker can make a request look like loopback traffic in two ways: through a same-host reverse proxy, which makes every request behind it arrive at GPUStack with a loopback source address, or by simply sending a forged X-GPUStack-Real-IP: 127.0.0.1 header. In other words, the server was trusting a network-position signal — or a header the client controls — as proof of identity.

Once past that check, an attacker has full administrator access: they can list and change users, models, workers and configuration, create persistent administrator API keys, read worker credentials and cloud-provider secrets, and call admin-only endpoints such as POST /v2/inference-backends/from-yaml to push a custom backend definition — a path to running code on worker hosts.

Exploitation confirmed in the wild

GPUStack's advisory states plainly that the bypass has been observed in the wild against a deployment running version 2.1.1, where attackers created custom inference backends that ran reverse shells on the affected host. CISA's catalogue entry carries the same message in its own terms: it requires forensic triage before or alongside remediation, a flag the agency attaches when it believes a system may already be compromised, not merely vulnerable.

The advisory credits Nikko Enggaliano, Wei Yunzhou, and Rui Yang and Haoyu Wang of Johns Hopkins University with independently reporting the flaw, and Javier Sixto with reporting the active exploitation. No proof-of-concept code has been published, and neither CISA nor GPUStack has published a victim count, so wider claims about how many organisations have been hit should be treated as unconfirmed.

Patch to 2.2.2 — and a second flaw to close at the same time

GPUStack says version 2.2.0 removes the loopback auto-admin path entirely and hardens how the server handles client-IP detection and forwarded headers. But administrators should go further: a second, related authentication flaw, CVE-2026-102894, affects GPUStack's SAML single sign-on callback, which accepted a posted SAML response and issued a session token without verifying the response's signature — allowing an attacker to impersonate any identity, including an existing administrator. That flaw, rated CVSS 9.1, is fixed in version 2.2.2, so upgrading to 2.2.2 or later closes both issues in one move.

If an upgrade cannot be done immediately, GPUStack's advisory recommends setting force_auth_localhost=true, stripping any client-supplied X-GPUStack-Real-IP header at the edge or reverse proxy, and keeping the GPUStack API off the open internet behind a VPN or authenticated gateway. There is no configuration workaround for the SAML flaw; access to /auth/saml/callback should be blocked at the proxy until the upgrade is done.

Any instance that was exposed to the internet before today should be treated as potentially compromised: check for unexpected administrator API keys, unfamiliar inference-backend definitions and worker processes that were not created by your own team, and rotate worker credentials and cloud-provider secrets after patching.

Sources: GPUStack security advisory GHSA-gj9m-f8ph-pmhr and Pandromeda.