CVE-2026-102895: GPUStack Improper Authentication Vulnerability

Summary

GPUStack contains an improper authentication vulnerability, tracked as CVE-2026-102895, that allows unauthenticated administrative access. An attacker can change users and models, create persistent administrator API keys, and disclose worker and cloud-provider secrets. The flaw also enables code execution through POST /v2/inference-backends/from-yaml.

Mitigation

Apply mitigations in accordance with vendor instructions, following CISA's BOD 26-04 guidance and its Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure and adhere to BOD 26-04 patching guidelines. Due date: 2026-11-12.

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News