SANS ISC reports active exploit attempts against GPUStack authentication-bypass flaw

The SANS Internet Storm Center reported active attempts to exploit CVE-2026-102895, a trivial authentication-bypass flaw in GPUStack; CISA added the flaw to the Known Exploited Vulnerabilities catalog on Monday.

The SANS ISC diary entry describing the attempts was written by Johannes B. Ullrich, Ph.D., Dean of Research at SANS.edu. The vulnerability affects all GPUStack releases earlier than version 2.2.0 and has a CVSS score of 9.8. GPUStack is open-source software for managing GPU clusters used in AI workloads.

An attacker who forges the X-Gpustack-Real-IP header can make GPUStack believe a request comes from loopback address 127.0.0.1, and the software then skips authentication. The header is meant to identify where a request originates. Because 127.0.0.1 belongs to the local machine, GPUStack assumes the request comes from within the host and skips identity checks; that local-loopback assumption enables the header-spoofing attack.

A front-end proxy typically adds these headers, and the receiving application trusts them when making security decisions; GPUStack’s misplaced trust means a forged header can strip away the login requirement entirely. GPUStack groups X-Gpustack-Real-IP with other common headers that record where a request comes from, such as Forwarded, X-Forwarded-For, and X-Real-IP. An application can no longer treat them as trustworthy once it uses them to decide who gets in.

SANS ISC observed exploit requests carrying X-Gpustack-Real-IP set to 127.0.0.1. Those requests came from IP address 144.91.73.103. The same address has recently scanned AI-related paths including /v1/models and /models.

The flaw allows unauthenticated administrative access. An attacker could change users and models, create persistent administrator API keys, and disclose worker and cloud-provider secrets. Attackers can achieve code execution through POST /v2/inference-backends/from-yaml. The GPUStack maintainers described the activity as “active in-the-wild exploitation.”

Version 2.2.0 came out at the end of June, and the fix became available in July 2026. The maintainers issued an advisory about the flaw on July 31, 2026, and credited four researchers for independently reporting it: Nikko Enggaliano, Wei Yunzhou, Rui Yang, and Haoyu Wang.

Javier Sixto of Ulex Innovative Systems told the maintainers about active exploitation in the wild. The flaw was disclosed at the end of July, and the identifier was assigned on Nov. 4.

Anyone running a release earlier than version 2.2.0 is affected by the flaw. GPUStack looks attractive to attackers because it manages GPU clusters that typically run AI workloads. Agencies in the Federal Civilian Executive Branch face a Nov. 12, 2026 deadline to apply fixes.