CISA added CVE-2026-102895 to its Known Exploited Vulnerabilities catalogue on 9 November 2026, with a federal due date of 12 November 2026. The listing covers an authentication-bypass flaw in GPUStack, an open-source GPU cluster manager, that the project’s own advisory describes as granting unauthenticated administrative access when loopback sources are trusted by default.
The GPUStack vulnerability is tracked in advisory GHSA-gj9m-f8ph-pmhr. It affects versions before 2.2.0 and is patched in 2.2.0. CISA’s ransomware-use field for the KEV entry is not a claim of ransomware campaigns in the advisory text itself; treat campaign linkage as unstated beyond the KEV catalogue’s own fields.
Federal civilian agencies covered by Binding Operational Directive 22-01 must remediate by the listed due date. For everyone else, the three-day window from listing to due date is a practical urgency signal rather than a legal deadline, and it arrives in the same 9 November KEV wave as other infrastructure CVEs already tracked by TSN.
How the bypass works, in the advisory’s words
In GPUStack before v2.2.0, get_current_user promotes any request whose source is considered loopback to the built-in administrator account when force_auth_localhost is False (the default). The advisory says that source can be made to report 127.0.0.1 without credentials in two ways: a same-host reverse proxy whose TCP peer is loopback, or a forged X-GPUStack-Real-IP: 127.0.0.1 header.
Either path, the advisory says, yields “full, unauthenticated administrative access” over the network—enumerating and modifying users, models, workers and configuration; minting persistent admin API keys; and reading worker credentials and cloud/provider secrets. Combined with admin-only functionality such as POST /v2/inference-backends/from-yaml, “this leads to code execution on worker hosts.”
The advisory states: “This vulnerability has been observed exploited in the wild against a v2.1.1 deployment (attacker-created custom backends running reverse shells).” That is the vendor’s wording, not an independent incident report with victim counts. TSN is not restating it as a confirmed multi-victim campaign; the quote is the evidence floor.
What to do
Upgrade to GPUStack 2.2.0 or later, where the loopback auto-admin path was removed and forwarding-header handling was hardened. As a workaround while patching, set force_auth_localhost=true, strip client-supplied X-GPUStack-Real-IP at the edge, and keep the API off untrusted networks. Operators who run GPUStack behind a same-host reverse proxy should treat that topology as in-scope even when the public edge looks authenticated.
The same KEV wave on 9 November also covered other infrastructure flaws already tracked by TSN, including the SonicWall SSLVPN KEV listing pattern and the Alpine OpenSSH password-authentication bypass now listed as CVE-2026-123158. Operators should treat the 12 November federal due date as a hard calendar mark for covered agencies, and as a practical urgency signal for everyone else running GPUStack behind a same-host proxy.
Localhost trust fails as soon as the proxy sits on the same box
Authentication that treats “came from 127.0.0.1” as proof of admin is really authentication of the network path, not of the user. The moment a reverse proxy terminates TLS on the same host and forwards to the app on loopback, every remote caller inherits that trusted peer address. A client-controlled real-IP header makes the same mistake explicit: the application is trusting a claim about identity that the client can write.
That is why the patch removes the auto-admin path rather than asking operators to “be careful with proxies.” Workarounds that force authentication on loopback or strip the header at the edge are useful bridges; they are not substitutes for 2.2.0 if the goal is to stop minting enduring admin API keys from an unauthenticated request. Once those keys exist, the original bypass is no longer required for follow-on access.
The useful next evidence is operational: whether exposed v2.1.x instances show the custom-backend reverse-shell pattern the advisory describes, and whether GPUStack’s default install docs keep operators away from same-host proxy shapes that reintroduce loopback trust. Until then, the durable facts are the KEV date, the 2.2.0 fix, and the advisory’s own account of in-the-wild abuse against v2.1.1.
Sources
Related stories
Alpine OpenSSH’s KEV listing is the nearest same-day CISA counterpart: another authentication-bypass class flaw with a 12 November federal due date and ransomware use listed as Unknown.
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
