CISA adds GPUStack authentication flaw allowing admin access to KEV

CISA added CVE-2026-102895 to its Known Exploited Vulnerabilities (KEV) catalogue on 9 November 2026. The vulnerability affects GPUStack, an open-source product, and could allow unauthenticated users to gain administrative access.

The GPUStack Improper Authentication Vulnerability can enable changes to users and models, creation of persistent administrator API keys, and disclosure of worker and cloud-provider secrets. It may also allow code execution through POST /v2/inference-backends/from-yaml. The vulnerability has a CVSS score of 9.8, rated Critical. Patch status is unknown, and no patch or advisory URL was provided.

KEV inclusion means CISA has confirmed active exploitation. Use in ransomware campaigns is unknown. CISA’s remediation deadline is 12 November 2026.

CISA requires organisations to apply mitigations in accordance with vendor instructions, comply with BOD 26-04 guidance and CISA’s Forensics Triage Requirements, and follow applicable BOD 26-04 guidance for cloud services; if mitigations are unavailable, discontinue use of the product. Federal Civilian Executive Branch (FCEB) agencies are directly subject to the applicable CISA requirements. All organisations should assess asset exposure, including internet exposure, and review their remediation plans.

For full details, consult the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2026-102895) and the [CISA KEV catalogue](https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog).