Exploit Attempts Target GPUStack Authentication Bypass Vulnerability
Attackers are actively exploiting CVE-2026-102895, an authentication bypass flaw in GPUStack, by spoofing custom headers to gain unauthorized access.
Exploit attempts are actively targeting CVE-2026-102895, a critical authentication bypass vulnerability affecting all versions of GPUStack prior to 2.2.0. GPUStack is an open-source tool designed to manage clusters of GPUs, commonly utilized for AI workloads. The vulnerability, which was assigned a CVE on November 4th, was publicly disclosed at the end of July, following its discovery.
The root cause of the vulnerability lies in the software's trust of custom headers added by proxy servers. Attackers can forge these headers, specifically the 'X-Gpustack-Real-IP' header, to impersonate legitimate loopback traffic. When GPUStack interprets this spoofed header as originating from a trusted internal source (like 127.0.0.1), it bypasses its own authentication and access control mechanisms, granting the attacker unauthorized entry.
This exploit pattern is a well-known security pitfall, where applications rely on headers like 'Forwarded', 'X-Forwarded-For', or 'X-Real-IP' to determine the client's true IP address. While useful for logging or routing, these headers can be easily manipulated if not properly validated by the backend application. In the case of GPUStack, the trust placed in 'X-Gpustack-Real-IP' allows for a straightforward bypass.
Observed exploit attempts typically involve simple HTTP GET requests to the root path of the GPUStack instance. These requests include the malicious 'X-Gpustack-Real-IP: 127.0.0.1' header, aiming to trick the application into believing the request originates from the local machine. The SANS Internet Storm Center has observed these exploit attempts originating from the IP address 144.91.73.103.
Further analysis of traffic from the identified malicious IP address reveals that attackers are not only probing for the authentication bypass but are also attempting to interact with various AI model endpoints. This includes requests for '/v1/models', '/v1beta/models?key=x', '/v1/messages', and '/models', suggesting a potential intent to enumerate available models or even interact with them post-exploitation.
Given the nature of the vulnerability and the target software, the impact could be significant for organizations using GPUStack for their AI infrastructure. Unauthorized access could lead to the theft of sensitive data, manipulation of AI models, disruption of services, or the use of compromised GPU resources for malicious purposes.
As of the disclosure, GPUStack versions prior to 2.2.0 are vulnerable. Users are strongly advised to update to version 2.2.0 or later to mitigate this risk. Organizations should also review their network configurations and implement stricter validation of incoming headers, particularly those that influence authentication and authorization decisions, as a defense-in-depth measure.