Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)
A critical authentication bypass vulnerability (CVE-2026-102895) in GPUStack is being actively exploited, allowing attackers to access AI computing resources.
The vulnerability stems from improper handling of the 'X-Gpustack-Real-IP' header, which GPUStack uses to identify request origins. When this header is spoofed to indicate a loopback address (127.0.0.1), the system incorrectly treats the request as coming from a trusted source and bypasses authentication checks.
GPUStack is open-source software designed to manage clusters of GPUs typically used for AI workloads, making it an attractive target for attackers seeking computational resources. The vulnerability affects all versions prior to 2.2.0, which was released at the end of June to address this security flaw.
Active Exploitation Underway
The SANS Internet Storm Center has observed active exploitation attempts originating from IP address 144.91.73.103. These attacks use straightforward HTTP requests with the spoofed header to bypass authentication.
The requests we are seeing right now are pretty straightforward: GET / HTTP/1.1 Host: [redacted] Accept-Encoding: identity User-Agent: Mozilla/5.0 X-Gpustack-Real-IP: 127.0.0.1
Targeting AI Resources
In addition to the basic authentication bypass, the attacking IP has been probing for other AI-related endpoints including /v1/models, /v1beta/models, /v1/messages, and /models. This suggests attackers are attempting to identify and access valuable AI model resources and services.
Organizations using GPUStack should immediately upgrade to version 2.2.0 or later to mitigate this vulnerability. The CVE was officially assigned on November 4th, though the vulnerability remained undisclosed until late July, potentially leaving systems exposed during this window.
Related
