Skip to content
OpenAdvisories

Vendor

gpustack

4 known vulnerabilities.

Products

gpustack 4
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-102894

    GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover

    GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_…

    gpustack gpustack gpustack PyPI
  • Critical 9.8
    CVE-2026-102895 Exploited

    GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

    GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, wh…

    gpustack gpustack gpustack PyPI
    KEV Nov 9, 2026