CVE-2026-103002
HighCVSS 8.8Summary
In GPUStack from 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, allowing the caller to read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. This is fixed in version 2.2.2.
Risk Assessment
A low-privileged user could gain broad access to the Kubernetes cluster, including code execution in the target cluster. This poses a serious risk to confidentiality and integrity of the environment.
Recommendation
Update GPUStack to version 2.2.2 or later. Until patched, restrict access to the proxy and review the permissions of ServiceAccounts used by workers.
Other vulnerabilities in GPUStack
See all- CVE-2026-102895Critical
GPUStack prior to 2.2.0 treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1, allowing unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution.
- CVE-2026-102894Critical
GPUStack from 0.7.1 until 2.2.2 contains an /auth/saml/callback endpoint that decodes SAML XML and uses its NameID and attributes to resolve or provision a user without verifying the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new account, even when SAML was not configured.
- CVE-2026-58658High
GPUStack through version 2.2.1 contains an unauthenticated information disclosure vulnerability that allows attackers to access sensitive inference logs and modify worker configuration via unprotected /serveLogs and /debug endpoints on the worker port. Attackers can enumerate model instance IDs to stream serving logs containing prompts and completions, change log levels, and read memory profiling data without any authentication.
Original NVD description (English source)
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS