CVE-2026-102895
CRITICAL CISA KEV
ACT NOW
Priority: 0.05
BB Relevance:
80/100
Published: 2026-11-04
Modified: 2026-11-10
First seen: 2026-11-04
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml.
CISA Known Exploited Vulnerability
Vendor / Product
GPUStack — GPUStack
Date Added
2026-11-09
Remediation Due
2026-11-12
This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-102895
Weakness Classification (3)
Affected Software (7)
References & Advisories (5)
x_refsource_MISC
x_refsource_MISC
x_refsource_MISC
x_refsource_CONFIRM