CISA Adds GPUStack Vulnerability to KEV List Amid Active Exploitation

## Overview CISA added CVE-2026-102895 to its Known Exploited Vulnerabilities (KEV) list on November 9, 2026. This vulnerability affects GPUStack, an open-source GPU cluster manager. The addition signals a federal deadline for patching by November 12, 2026, due to evidence of active exploitation. ## Technical Details The vulnerability resides in the `get_current_user` function within `gpustack/api/auth.py`. Prior to version 2.2.0, the function incorrectly treated loopback requests as originating from the built-in administrator when the `force_auth_localhost` setting was false, which was the default configuration. This allowed a remote request to masquerade as a local request. The `client_ip_getter` function accepted reverse proxy peers or a client-supplied `X-GPUStack-Real-IP` header, enabling this bypass. ## Impact Exploitation of this vulnerability allows unauthenticated users to gain administrative access. Attackers can change user and model configurations, create persistent administrator API keys, disclose sensitive worker and cloud-provider secrets, and execute code through the `/v2/inference-backends/from-yaml` endpoint. Reports indicate that exploitation has occurred in the wild against GPUStack version 2.1.1. ## Mitigation Defenders should upgrade to GPUStack version 2.2.0 immediately to mitigate this vulnerability. Organizations using affected versions should also review their configurations to ensure that `force_auth_localhost` is set to true, limiting access to local requests only. Failure to address this vulnerability could lead to significant security risks.