Missing authorization in GPUStack cluster proxy exposes Kubernetes clusters
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
GPUStack from 2.2.0 before 2.2.2 forwards requests from authenticated non-administrator users to a selected Kubernetes cluster without a resource-level authorization check. The proxy uses a reachable worker's Kubernetes ServiceAccount credentials, so a caller can read sensitive resources, create or modify workloads, or delete resources within that ServiceAccount's permissions. Exploitation requires a Kubernetes-provider cluster with a reachable worker, and an attacker can run code in the target cluster through attacker-controlled workloads. CWE-862 and CWE-639 apply.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level authorization check. The proxy used a reachable worker's Kubernetes ServiceAccount credentials, so the caller could read sensitive resources, create or modify workloads, or delete resources according to that ServiceAccount's permissions. Exploitation required a Kubernetes-provider cluster with a reachable worker, and attacker-controlled workloads could result in code execution in the target cluster. This issue is fixed in version 2.2.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Update GPUStack to version 2.2.2, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA gpustack (gpustack) Fixed in 2.2.2
Vendor assessments
Timeline
- 2026-11-04 Threatist record created from CVE-2026-103002
- 2026-11-06 Priority changed: MEDIUM → LOW
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
- 2026-11-06 CISA SSVC decision points changed
- 2026-11-06 Priority changed: LOW → MEDIUM
- 2026-11-06 CISA SSVC decision points changed
References
Other 6
- https://github.com/gpustack/gpustack/security/advisories/GHSA-3hch-x692-6qj3
- https://github.com/gpustack/gpustack/pull/5911
- https://github.com/gpustack/gpustack/pull/5936
- https://github.com/gpustack/gpustack/commit/363191fa1da7e1426c6041f78b3cf00aff2622fe
- https://github.com/gpustack/gpustack/commit/cdd67467e0f314609dc82216e142940d321abfed
- https://github.com/gpustack/gpustack/releases/tag/v2.2.2
More gpustack vulnerabilities
- TI-2026-42223 GPUStack Unauthenticated Information Disclosure via Worker Endpoints CVSS 4.0HIGH 8.8
- TI-2026-85210 Authentication bypass in GPUStack grants unauthenticated admin access CVSS 3.1CRITICAL 9.8
- TI-2026-85212 Unverified SAML responses in GPUStack allow authentication bypass CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-103002 · CVE Program
- CVE-2026-103002 · NVD
- FIRST EPSS
- CVE-2026-103002 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences