CVE-2026-102895 is a trivial authentication-bypass vulnerability. GPUStack is also an attractive target. It is open-source software that manages clusters of GPUs, which are typically used to run AI workloads. All versions of GPUStack prior to 2.2.0, which was released at the end of June. This vulnerability was not made public until the end of July, and the CVE was assigned on November 4th.
The vulnerability stems from a common pattern: proxies add custom headers, and the recipient trusts them. An attacker can spoof these custom headers, thereby bypassing authentication and/or access control. In this particular case, the header in question is “X-Gpustack-Real-IP”. Like similar headers (Forwarded, X-Forwarded-For, X-Real-IP), this header is intended to help identify the IP address from which the request originates. This is all nice and safe as long as no security decisions are made. But this is exactly what happens with GPUStack. If the “X-Gpustack-Real-IP” identifies loopback (127.0.0.1) as the source of the request, Gpustack bypasses authentication (after all, the request originates from a trusted source)
The requests we are seeing right now are pretty straightforward:
GET / HTTP/1.1
Host: [redacted]
Accept-Encoding: identity
User-Agent: Mozilla/5.0
X-Gpustack-Real-IP: 127.0.0.1
The IP address we see as the origin of these requests is 144.91.73.103. In the last couple of days, we have seen this IP look for other AI-related resources:
/v1/models
/v1beta/models?key=x
/v1/messages
/models
https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr
—
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.