{"data":{"id":"f7f4a48c-5a40-4d07-a627-c89d811731b5","title":"CVE-2026-102895: GPUStack Improper Authentication Vulnerability","summary":"GPUStack contains an improper authentication vulnerability, tracked as CVE-2026-102895, that allows unauthenticated administrative access. An attacker can change users and models, create persistent administrator API keys, and disclose worker and cloud-provider secrets. The flaw also enables code execution through POST /v2/inference-backends/from-yaml.","solution":"Apply mitigations in accordance with vendor instructions, following CISA's BOD 26-04 guidance and its Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure and adhere to BOD 26-04 patching guidelines. Due date: 2026-11-12.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102895","publishedAt":"2026-11-09T00:00:00.000Z","cveId":"CVE-2026-102895","cweIds":["CWE-287","CWE-290","CWE-346"],"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["GPUStack"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"active","epssScore":0.00331,"epssCheckedAt":"2026-11-09T18:09:50.978Z","kevDateAdded":"2026-11-09","advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-09T18:09:53.992Z","patchAvailable":true,"disclosureDate":"2026-11-09T00:00:00.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-114"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}