# CVE-2026-102895

Auth bypass in GPUStack allows unauthenticated admin access and remote code execution.

- Page: https://www.vulneraibility.com/cve/CVE-2026-102895
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2026-11-09; CISA due date 2026-11-12
- EPSS: 0.56% (percentile 46.7)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2026-11-05)
- Weakness: CWE-287, CWE-290, CWE-346
- Also known as: GHSA-gj9m-f8ph-pmhr
- Published: 2026-11-04

## Affected versions

- gpustack: affected < 2.2.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated attacker can gain admin, create persistent API keys, modify users/models, exfiltrate cloud/worker secrets, and achieve RCE via POST /v2/inference-backends/from-yaml.

## Action

Immediate action required

## Recommendation

Upgrade to GPUStack v2.2.0 immediately; block internet access and rotate exposed keys/secrets.

## References

- [other] https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr
- [other] https://github.com/gpustack/gpustack/pull/5346
- [other] https://github.com/gpustack/gpustack/commit/53f42a6a553542974396d16a4ff6b12bcbedb48d
- [other] https://github.com/gpustack/gpustack/releases/tag/v2.2.0
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-102895

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.