GPUStack CVE-2026-102895 exploited: proxy makes every request admin

If you self-host models on GPUStack behind Nginx, assume strangers had admin. GPUStack CVE-2026-102895 is a CVSS 9.8 authentication bypass, and the project's own advisory says it was exploited in the wild against a v2.1.1 deployment, with attackers creating custom backends that ran reverse shells. On November 9, CISA added it to the Known Exploited Vulnerabilities catalog.

What actually happened

From the GitHub security advisory GHSA-gj9m-f8ph-pmhr:

• The bug. Before 2.2.0, GPUStack promoted any request from a "loopback" source to the built-in administrator when force_auth_localhost was False, which was the default.
• Path one: your reverse proxy. The standard self-hosted setup is GPUStack behind a same-host proxy with proxy_pass http://127.0.0.1:<port>. Every remote request then arrives from 127.0.0.1, so every request gets admin. No header, no credential.
• Path two: a header. A forged X-GPUStack-Real-IP: 127.0.0.1 header could do the same.
• Impact. Full admin over the network: users, models, workers and configuration. Attackers can mint persistent admin API keys with scope ["*"], read worker credentials and cloud/provider secrets, and get code execution on worker hosts through admin-only endpoints such as POST /v2/inference-backends/from-yaml.
• Fix. Version 2.2.0 removes the loopback auto-admin path and hardens forwarding-header handling.

Why it matters for your business

"Run your own models" is a good cost and privacy play. It also means you own the patching. The setup that turns this bug from bad into wide open is the textbook one: app on localhost, Nginx in front, TLS on the proxy. "Localhost is trusted" stops being true the moment a proxy sits on the same box.

If you or a contractor stood up GPUStack:

1. Upgrade to 2.2.0 or later today. Then check the repo's Security tab for other open advisories.
2. Assume compromise if it was internet-facing. Upgrading doesn't revoke keys an attacker already minted. List and delete API keys you didn't create, review users, and look for inference backends you didn't add.
3. Rotate the secrets it held. Worker credentials and any cloud or model-provider keys stored in GPUStack.
4. Can't upgrade yet? Set force_auth_localhost=true, strip X-GPUStack-Real-IP at the edge, and put the API behind a VPN.

Sources: GPUStack advisory GHSA-gj9m-f8ph-pmhr, CISA.