Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)
Exploit attempts targeting GPUStack authentication bypass vulnerability CVE-2026-102895 observed.
Exploit attempts for CVE-2026-102895, a trivial authentication bypass vulnerability in GPUStack, have been observed. The vulnerability allows attackers to spoof the 'X-Gpustack-Real-IP' header to bypass authentication. GPUStack version 2.2.0 and later, released in June, addresses this issue. The observed exploit attempts originate from IP address 144.91.73.103.
AI summary of the linked source. Not reviewed by an editor. How this works
Run GPUStack?
Get an email when a new story names GPUStack, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCVE-2026-102895 is a trivial authentication bypass in GPUStack that allows attackers to spoof the 'X-Gpustack-Real-IP' HTTP header and completely circumvent authentication controls. This class of vulnerability — trusting a client-supplied header for access decisions — represents a fundamental flaw in authentication logic and is straightforward to exploit, requiring little sophistication. A fix was available in GPUStack version 2.2.0 since June, yet active exploit attempts are now being observed, meaning organizations running unpatched instances are exposed to fully automated attacks. This incident underscores that for internet-facing services, the gap between patch availability and patch deployment is a directly exploitable window of risk.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
- Next-generation firewall and intrusion prevention
Malicious traffic is blocked at the network edge and between zones.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-102895
- ip — 144.91.73.103
- url — https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr