Dashboard / CVE-2026-58658

CVE-2026-58658

HIGH
MEDIUM Priority: 0.05 BB Relevance: 78/100
Published: 2026-07-15 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
AT: None
VC: High
VI: Low
VA: None

Description

GPUStack through 2.2.1, fixed in commit 4e20551, contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to access sensitive inference logs and modify worker configuration by exploiting unprotected /serveLogs and /debug endpoints on the worker port. Attackers can enumerate model instance IDs to stream serving logs containing prompts and completions, change log levels, and read memory profiling data without any authentication.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
gpustack gpustack 0

References & Advisories (3)

https://github.com/gpustack/gpustack/issues/5836
technical-description exploit issue-tracking

Bug Bounty Relevance

78 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

8.8 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.53%
Raw Score 0.005350
Percentile 45.7%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00535
2026-11-12
0.00535
2026-11-10
0.00535
2026-11-09
0.00535
2026-11-08
0.00535

Intelligence Sources

mitre ref →

External Links