GPUStack Authentication Bypass Exploited in Scanning Attempts

GPUStack has a trivial authentication-bypass vulnerability, tracked as CVE-2026-102895, with all versions prior to 2.2.0 (released end of June) affected. The disclosure notes that the weakness arises from a trust-on-header pattern: proxies add custom headers and the application uses these headers for security decisions. In this case, the header is X-Gpustack-Real-IP.

If this header identifies a loopback source (127.0.0[.]1), GPUStack proceeds as though the request originates from a trusted source and bypasses authentication or access control.

Evidence observed by the ISC shows attack-like requests using GET / HTTP/1.1 with the header X-Gpustack-Real-IP: 127.0.0[.]1, while the apparent origin IP is 144.91.73[.]103. In the last couple of days the same IP has been scanning for AI-related resources, including endpoints such as /v1/models, /v1beta/models?key=x, /v1/messages, and /models. The advisory linked in the diary is GHSA-gj9m-f8ph-pmhr, and the vulnerability was not made public until the end of July, with the CVE assigned on 4 November.

GPUStack is open-source software that manages clusters of GPUs used for AI workloads, making it an attractive target for exploitation, according to the diary by Johannes Ullrich, Dean of Research at SANS[.]edu.