CISA confirms exploitation of GPUStack authentication bypass flaw
CISA added CVE-2026-102895 in GPUStack to the KEV list; the flaw allows unauthenticated administrative access, including persistent API-key creation and code execution. The federal mitigation deadline is November 12, 2026. Exposed instances should be secured following vendor instructions.
In this article
For the technical team
- CVE
- CVE-2026-102895
- Affected
- GPUStack, plataforma de gestão de clusters de GPU para IA
- Exploitation
- Exploitation confirmed
- Fix
- Fix unconfirmed
Timeline
Incident opened.
