ETK-2026-4189Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-4189",
  "cve_id": null,
  "display_id": "ETK-2026-4189",
  "ghsa_id": "GHSA-9vwx-hfm8-g59g",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Authorization bypass in GPUStack management API",
  "summary": "GPUStack versions 2.2.0 through 2.3.0 do not consistently confine cluster and worker service credentials to their intended cluster and operations. An attacker with network access and a valid affected service credential or registration token can access management functions outside that credential's scope, including obtaining other registration tokens and changing infrastructure configuration.",
  "mitigation": "Upgrade GPUStack to version 2.3.1. Until the upgrade is complete, limit management API access to trusted hosts, protect affected credentials, and rotate tokens or service credentials that may have been exposed.",
  "vendor": "pip",
  "product": "pip:gpustack",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.2.0, < 2.3.1"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "2.3.1"
      ],
      "package_name": "gpustack",
      "purl": "pkg:pypi/gpustack"
    }
  ],
  "cwes": [
    284
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 31.532983966666666,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-11T16:22:53+00:00",
      "days": -0.06359718873842593,
      "is_lower_bound": true,
      "measured_at": "2026-11-11T17:54:27.842158+00:00",
      "url": "https://github.com/gpustack/gpustack/security/advisories/GHSA-9vwx-hfm8-g59g"
    }
  }
}