GPUStack flaw lets attackers bypass authentication with spoofed IP header

A SANS Internet Storm Center diary item reports attackers targeting GPUStack, a system that makes GPU clusters available for AI workloads. A special header, X-GPUStack-Real-IP, is added by fronting proxies and, while spoofing this header is a known risk, exploitation becomes straightforward if an attacker makes the real IP appear as the loopback address. In that scenario the intruder can bypass authentication.

The vulnerability’s fixed version reportedly released in July, with the CVE number assigned about a week earlier; a GitHub page containing details is described as existing for a couple of months. The diary notes exploitation is trivial and requires no complex exploit beyond exploiting the header and an exposed system, while the scope of affected deployments remains unclear.

ConnectWise’s ScreenConnect is also flagged, with a security advisory indicating an ongoing investigation into 400 compromised environments. Investigators point to third‑party plugins as likely culprits and have disabled them. Users are urged to ensure they run the latest ScreenConnect client, version 26.6.5, which also fixes a vulnerability being used to spread malware in compromised networks. ScreenConnect is commonly used for remote support, which attackers leverage to reach further into targets.

The diary references publicly accessible exploits for at least three vulnerabilities affecting N-able products; a GitHub repo contains exploit code, though the author has not verified its safety. Administrators running N-able are advised to upgrade promptly and to assume compromise for exposed unpatched systems. Microsoft 365 experienced a significant availability event affecting Exchange, Outlook and related services, with logins via Entra SSO potentially impacted. The outage appeared to degrade the Microsoft status page’s responsiveness at times.