GPUStack authentication flaw exploited to seize AI servers

Threat actors are exploiting a critical GPUStack authentication bypass in the wild to seize control of AI servers. The report, attributed to researcher Javier Sixto of ulex[.]fr, notes active abuse of CVE-2026-102895 (CVSS 9.8) against a v2.1.1 deployment, allowing remote attackers to gain unauthenticated admin access and run reverse shells on worker hosts.

The bypass stems from an origin check flaw (CWE-346) and IP spoofing issue (CWE-290) in the login code, whereby a loopback source (127.0.0[.]1) can be accepted as trusted. Two practical exploit paths are highlighted: when the server sits behind a same-host reverse proxy, external requests appear to originate from 127.0.0[.]1; or via a forged X-GPUStack-Real-IP header, both enabling auto-admin without a password.

Researchers and analysts describe this as yielding full unauthenticated network administrative access, enabling theft of cloud keys, minting of admin tokens, and injection of rogue YAML to run code on workers.

A second flaw, CVE-2026-102894 (CVSS 9.1), concerns the SAML login callback and is described as an unverified, replayable token path. The advisory notes no confirmed in-the-wild attacks for this SAML issue yet, though private exploits were shared with the developers. Affected versions are broad: CVE-2026-102895 impacts all builds before 2.2.0 (wild attacks seen on 2.1.1), while CVE-2026-102894 affects 0.7.1 to before 2.2.2.

Patches are to version 2.2.2, with interim mitigations to set force_auth_localhost=true and strip X-GPUStack-Real-IP headers, and to block external traffic to /auth/saml/callback until patching.