GPUStack admin access was free for the taking, and attackers took it
A default-on flag in the open-source GPU cluster manager let any remote request pass as an admin. CISA added it to its exploited list on 9 November.
GPUStack, the open-source cluster manager people use to serve LLMs across their own GPUs, shipped with an authentication check that trusted the wrong thing. Its get_current_user function granted built-in administrator access to any request that looked like it came from localhost, and that check was on by default (force_auth_localhost=false) in every version before 2.2.0.
Two ways get you there with no credentials at all. Run GPUStack behind the common same-host reverse-proxy setup and every remote request arrives with a TCP peer address of 127.0.0.1, which is enough on its own. Or just send the header X-GPUStack-Real-IP: 127.0.0.1. From admin, an attacker can mint a persistent API key, read worker and cloud-provider credentials, and push a custom inference backend that runs code on the worker host. CISA added CVE-2026-102895 to its Known Exploited Vulnerabilities catalogue on 9 November, citing exploitation already seen against a 2.1.1 deployment.
Why it matters: if you’re self-hosting model serving instead of calling a vendor API, GPUStack is exactly the kind of tool this hits, and the flaw is in the default configuration, not an edge case. Upgrade to 2.2.0, or if you can’t yet, set force_auth_localhost=true and make sure your reverse proxy strips any client-supplied X-GPUStack-Real-IP header before it reaches the app.
force_auth_localhost=true