CVE-2026-102895 - GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
CVE ID :CVE-2026-102895 Published : Nov. 4, 2026, 10:17 p.m. | 48 minutes ago Description :GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the...