Threat watch / Vulnerability
GPUStack: a forged header gives attackers admin over AI model servers, exploited in the wild
GPUStack, an open-source platform for running AI models on GPU clusters, trusted any request that appeared to come from the local machine. A request with a forged X-GPUStack-Real-IP: 127.0.0.1 header, or one passed through a reverse proxy on the same host, was treated as an unauthenticated admin, and an admin can register a custom inference backend that runs commands. The project fixed it in version 2.2.0 and says the flaw was exploited in the wild against a 2.1.1 deployment. CISA added it to its list of exploited flaws on November 9, 2026, according to The Hacker News.
- Sector
- Many sectors
- Way in
- Software flaw
- Product or vendor
- GPUStack
- How it happened
- A loopback trust flaw (CVE-2026-102895, CVSS 9.8): GPUStack before 2.2.0 treats requests that look local as trusted, so a forged X-GPUStack-Real-IP: 127.0.0.1 header, or any request relayed by a same-host reverse proxy, gets unauthenticated admin access. Code execution follows by creating a custom inference backend through POST /v2/inference-backends/from-yaml.[1][2] Checked 11 Nov 2026
- What was stolen
- Not public yet Checked 11 Nov 2026
- Who was impacted
- Organizations running GPUStack before 2.2.0 with the server reachable by the attacker. The advisory reports one exploited deployment, running 2.1.1, where attackers created custom backends running reverse shells; no count of victims is public.[1] Checked 11 Nov 2026
- Threat actor
- Not attributed
- CVE
- CVE-2026-102895
Timeline
- GPUStack publishes advisory GHSA-gj9m-f8ph-pmhr for the loopback trust flaw, fixed in 2.2.0, credited to Nikko Enggaliano, Wei Yunzhou, and Rui Yang and Haoyu Wang of Johns Hopkins University. [1]
- CISA adds CVE-2026-102895 to its Known Exploited Vulnerabilities catalog, according to The Hacker News; no attacker is named. GPUStack's advisory states that the flaw "has been observed exploited in the wild against a v2.1.1 deployment (attacker-created custom backends running reverse shells)", a report it credits to Javier Sixto. [1][2]