CVE-2026-102895

{
  "etk_id": "ETK-2026-3546",
  "cve_id": "CVE-2026-102895",
  "display_id": "CVE-2026-102895",
  "ghsa_id": "GHSA-gj9m-f8ph-pmhr",
  "euvd_id": "EUVD-2026-117124",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Loopback-based authentication bypass in gpustack",
  "summary": "gpustack versions earlier than 2.2.0 can grant administrative access without credentials when a request is classified as originating from the local host. An attacker may alter administrative resources, access sensitive credentials, or reach features that can run code on worker systems when traffic passes through a same-host proxy or a client-controlled real-IP header is trusted.",
  "mitigation": "Upgrade gpustack to version 2.2.0 or later. Until upgraded, require authentication for local requests, remove client-supplied real-IP headers at the edge, and restrict API access to trusted networks.",
  "vendor": "pip",
  "product": "pip:gpustack",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 2.2.0"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "2.2.0"
      ],
      "package_name": "gpustack",
      "purl": "pkg:pypi/gpustack"
    }
  ],
  "cwes": [
    287
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": true,
  "pipeline_minutes": 29.23553155,
  "t0_at": "2026-11-04T21:16:59.842000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-04T22:14:01.469765+00:00",
      "days": 0.03960217320601852,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T21:16:59.842000+00:00",
      "url": null
    },
    "exploit": {
      "at": "2026-11-04T22:14:01.469765+00:00",
      "days": 0.03960217320601852,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T21:16:59.842000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-04T21:16:59.842000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T21:16:59.842000+00:00",
      "url": "https://github.com/gpustack/gpustack/security/advisories/GHSA-gj9m-f8ph-pmhr"
    }
  }
}