Attackers are exploiting CVE-2026-102895, a CVSS 9.8 authentication bypass in the open-source GPUStack GPU cluster manager, to gain administrator access and run reverse shells on AI servers. A second critical flaw, CVE-2026-102894, also affects the platform, though no exploitation of it has been confirmed.
CVE-2026-102895 Grants Admin Rights to Any Loopback Request
GPUStack manages GPU clusters used to serve AI models. In versions before 2.2.0, the server grants built-in administrator rights to any request that comes from a loopback address. The setting that would disable that behavior, force_auth_localhost, is false by default.
The weakness becomes remotely reachable in two ways. When GPUStack sits behind a reverse proxy on the same host, every outside request appears to arrive from 127.0.0.1. Alternatively, an attacker can send a spoofed X-GPUStack-Real-IP: 127.0.0.1 header. Either route produces unauthenticated administrator access.
Exploitation Seen Against a Version 2.1.1 Deployment
Researcher Javier Sixto of ulex.fr reported in-the-wild exploitation against a GPUStack v2.1.1 deployment. The attackers used custom backends to run reverse shells. Other analysts credited in the vendor advisories are Nikko Enggaliano, Wei Yunzhou, Rui Yang and Haoyu Wang. The date of the first attacks has not been stated, and the reporting does not say how many GPUStack servers were compromised or whether the attackers installed anything beyond reverse shells. The v2.1.1 target indicates the exposed deployment ran a release earlier than the 2.2.0 fix.
CVE-2026-102894 Skips Signature Checks on the SAML Callback
The second flaw, CVE-2026-102894, carries a CVSS score of 9.1 and affects versions from 0.7.1 up to 2.2.2. The /auth/saml/callback route reads a Base64-encoded XML username and issues a login token without validating the signature, the sender or the timestamp. The route is active by default even when SAML has not been configured, and captured logins can be replayed.
UC Berkeley researchers shared a private exploit for this flaw. No exploitation of CVE-2026-102894 has been confirmed. Because captured logins can be replayed, a single intercepted login request could be reused to impersonate the account it named, and the route’s default-on status means operators who never set up SAML are exposed anyway.
What an Administrator Gains on a GPUStack Cluster
Administrator access on GPUStack carries more than control of one application. Attackers with admin rights can steal cloud keys, mint further admin tokens and push YAML configurations that execute code on worker nodes. That combination allows a single compromised management server to become a foothold across every GPU node it controls.
GPU clusters are attractive because they hold expensive compute and the cloud secrets used to provision it. Thousands of teams pull the GPUStack package through pip and Docker Hub, which places the exposure across a broad population of AI development and inference environments.
GPUStack 2.2.2 Fixes Both Flaws; Interim Controls for Older Builds
GPUStack 2.2.0 removed the loopback auto-admin rule, and 2.2.2 added SAML signature checks. The recommended action is to upgrade to 2.2.2 or later. For deployments that cannot update immediately, the advisories list three interim measures: set force_auth_localhost to true, strip the X-GPUStack-Real-IP header at the reverse proxy, and block external access to /auth/saml/callback.
The pairing of a header-spoofing bypass with a default-on SAML route reflects how management layers for AI infrastructure often inherit assumptions from internal deployment, such as trusting the local machine. The loopback rule worked as designed only if nothing sat in front of the server, a condition that reverse proxies, standard in production deployments, routinely violate. The reporting does not say which of the two routes the attackers used against the v2.1.1 deployment.
The fixes arrived in stages: release 2.2.0 removed the loopback auto-admin rule and 2.2.2 added the SAML signature checks, so an upgrade to 2.2.2 or later covers both the loopback bypass and the callback route.
