---
id: CVE-2026-102895
title: >-
  GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP
  peer or X-GPUStack-Real-IP header) grants unauthenticated admin
summary: >-
  GPUStack is an open-source GPU cluster manager for AI model serving and GPU
  instance provisioning. Prior to 2.2.0, get_current_user in
  gpustack/api/auth.py treated a loopback request source as the built-in
  administrator when force_auth_l…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-287
  - CWE-290
  - CWE-346
vendor: gpustack
product: gpustack
affected:
  - gpustack < 2.2.0
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-11-05T19:06:06.486167Z'
published: '2026-11-04'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T04:56:39.998Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-102895'
references:
  - url: >-
      https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr
    label: >-
      https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr
  - url: 'https://github.com/gpustack/gpustack/pull/5346'
    label: 'https://github.com/gpustack/gpustack/pull/5346'
  - url: >-
      https://github.com/gpustack/gpustack/commit/53f42a6a553542974396d16a4ff6b12bcbedb48d
    label: >-
      https://github.com/gpustack/gpustack/commit/53f42a6a553542974396d16a4ff6b12bcbedb48d
  - url: 'https://github.com/gpustack/gpustack/releases/tag/v2.2.0'
    label: 'https://github.com/gpustack/gpustack/releases/tag/v2.2.0'
tags:
  - cve.org
epss: 0.00331
epssPercentile: 0.26401
ingestedAt: '2026-11-05T22:38:31.548Z'
---

## Overview

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.

## Affected

- `gpustack < 2.2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.