CISA Adds GPUStack RCE Flaw (CVE-2026-102895) to KEV Catalog Amid Confirmed Active Exploitation
The US cyber agency set a 12 November remediation deadline for the CVSS 9.8 flaw in the open-source AI inference cluster manager, warning that patching alone does not evict attackers.
CISA added CVE-2026-102895, a CVSS 9.8 flaw in GPUStack, an open-source GPU cluster manager used to serve AI models, to its Known Exploited Vulnerabilities catalog on 9 November, with a federal remediation deadline of 12 November and a forensic triage flag.
In versions below 2.2.0, requests that appear to originate from loopback are automatically treated as the built-in administrator because the force_auth_localhost setting defaults to false. Remote requests can masquerade as loopback through a reverse proxy on the same host or a spoofed X-GPUStack-Real-IP header. Confirmed exploitation on version 2.1.1 deployments used the flaw to mint persistent API keys, read stored worker and cloud-provider credentials, and register a malicious inference backend that executed code on worker hosts, opening a reverse shell.
Version 2.2.2 also closes CVE-2026-102894, a CVSS 9.1 SAML authentication bypass. The Cloud Security Alliance, which published a full analysis on 10 November, stressed that patching alone does not remove an attacker: accounts and keys created during a compromise must be revoked and all stored credentials rotated.