GPUStack Authentication Bypass Exploited in the Wild — Patch Now
Written by AI from the linked story. Not reviewed by an editor. How this works
CVE-2026-102895 is a trivial authentication bypass in GPUStack that allows attackers to spoof the 'X-Gpustack-Real-IP' HTTP header and completely circumvent authentication controls. This class of vulnerability — trusting a client-supplied header for access decisions — represents a fundamental flaw in authentication logic and is straightforward to exploit, requiring little sophistication. A fix was available in GPUStack version 2.2.0 since June, yet active exploit attempts are now being observed, meaning organizations running unpatched instances are exposed to fully automated attacks. This incident underscores that for internet-facing services, the gap between patch availability and patch deployment is a directly exploitable window of risk.
Tactical Insight
Immediate actions
- Upgrade GPUStack to version 2.2.0 or later immediately on all deployments
- Block inbound requests containing untrusted 'X-Gpustack-Real-IP' headers at the WAF or reverse proxy layer as a temporary mitigation
- Block or rate-limit traffic from known malicious IPs (e.g., 144.91.73.103) at the perimeter firewall
Long-term improvements
- Establish a formal patch SLA (e.g., critical vulnerabilities patched within 72 hours) and enforce it with tracked remediation tickets
- Maintain a complete, up-to-date inventory of all internet-facing services and their software versions to enable rapid impact assessment when new CVEs are disclosed
- Never trust client-supplied headers for authentication or authorization decisions in application design and code reviews
Detection measures
- Deploy alerting for anomalous or unexpected values in the 'X-Gpustack-Real-IP' header in web/application logs
- Integrate threat intelligence feeds so that known attacker IPs trigger automated alerts or blocks in real time
- Run continuous vulnerability scanning against internet-facing assets to detect unpatched software before attackers do