CVE-2026-102894
CriticalCVSS 9.1Summary
GPUStack from 0.7.1 until 2.2.2 contains an /auth/saml/callback endpoint that decodes SAML XML and uses its NameID and attributes to resolve or provision a user without verifying the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new account, even when SAML was not configured.
Risk Assessment
The vulnerability allows unauthenticated impersonation of any user, including an administrator, and replay of captured signed SAML responses. The risk includes full platform access and data confidentiality breaches.
Recommendation
Update GPUStack to version 2.2.2. Also verify whether the SAML endpoint was abused and rotate credentials and session keys.
Other vulnerabilities in GPUStack
See all- CVE-2026-103002High
In GPUStack from 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, allowing the caller to read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. This is fixed in version 2.2.2.
- CVE-2026-102895Critical
GPUStack prior to 2.2.0 treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1, allowing unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution.
- CVE-2026-58658High
GPUStack through version 2.2.1 contains an unauthenticated information disclosure vulnerability that allows attackers to access sensitive inference logs and modify worker configuration via unprotected /serveLogs and /debug endpoints on the worker port. Attackers can enumerate model instance IDs to stream serving logs containing prompts and completions, change log levels, and read memory profiling data without any authentication.
Original NVD description (English source)
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS