GPUStack CVE-2026-102895 Exploited: Forged Loopback Requests Hand Attackers Admin and Reverse Shells

Attackers have used an authentication bypass in GPUStack, the open-source manager for GPU clusters that serve AI models, to take over a deployment and open reverse shells on its worker machines. GPUStack's maintainers say CVE-2026-102895 was "observed exploited in the wild against a v2.1.1 deployment", and the flaw is scored CVSS 9.8. CISA added it to the Known Exploited Vulnerabilities catalogue on 9 November and gave US federal agencies until 12 November to deal with it.

How a remote request becomes the admin

When the force_auth_localhost setting is off, which is the default, GPUStack treats any request that appears to come from the machine itself as the built-in administrator. Two things make a remote request look local, the advisory explains: a reverse proxy on the same host, which makes all traffic arrive from 127.0.0.1, or a forged X-GPUStack-Real-IP: 127.0.0.1 header.

With that access an attacker can create admin API keys that keep working from any address, read worker credentials and cloud provider secrets, and change users, models and configuration. Combined with the admin-only POST /v2/inference-backends/from-yaml call, the bypass "leads to code execution on worker hosts". That is what happened in the attack the maintainers describe: the intruders registered custom inference backends that started reverse shells.

Attackers and victims unnamed

No one has named the attackers or said how many organisations were hit; eSecurityPlanet notes that CISA "has not identified the attackers or disclosed the number of affected organizations". The advisory itself was published on 31 July.

CISA's other three additions that day are covered separately: the IBM Aspera Faspex admin takeover, the OpenSSH password bypass on Alpine Linux and the FreeSWITCH SIP message flaw.

Fixed version and what to check

Upgrade to GPUStack 2.2.0 or later. Where that has to wait, the maintainers' workarounds are to set force_auth_localhost=true, strip any client-supplied X-GPUStack-Real-IP header at the proxy, and keep the API off untrusted networks.

Upgrading doesn't remove admin keys an attacker may already have minted. eSecurityPlanet advises reviewing administrator accounts, API keys, inference backends and worker configurations, revoking keys nobody recognises and rotating the cloud and worker credentials the server held.