Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)
CVE-2026-102895 is a trivial authentication-bypass vulnerability. GPUStack is also an attractive target. It is open-source software that manages clusters of GPUs, which are typically used to run AI workloads. All versions of GPUStack prior to 2.2.0, which was released at the end of June. This vulnerability was not made public until the end of July, and the CVE was assigned on November 4th.
Summary from US-CERT / SANS Internet Storm Center.
Explained
The technology and terms in this story. Learn more
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
- CWE-287Improper AuthenticationThe system doesn't properly prove who a user is, so attackers get in as someone else.
- CWE-290Authentication Bypass by SpoofingThe system trusts something an attacker can fake, such as a source address or header.
- CWE-346Origin Validation ErrorThe software doesn't verify where a message really came from, so forged messages are trusted.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.