Attackers exploit GPUStack flaw to gain admin control without logging in

What happened

GPUStack treated any request that seemed to come from the server itself as coming from the built-in administrator. This shortcut was active by default, because the force_auth_localhost setting shipped set to false.

An attacker on the network could make a remote request look local. One route was a reverse proxy running on the same host. The other was a forged loopback address supplied by the client in a request header. Either way, the attacker gets administrator access without a password.

With that access, an attacker can change users and models, create administrator API keys that stay valid, read secrets for workers and cloud providers, and run code on the server. Attacks have already hit a deployment running version 2.1.1. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 9 November 2026.

Who is affected

All GPUStack releases before 2.2.0 are affected. Installations that kept the default force_auth_localhost value of false accept these forged local requests as the administrator.

How serious is it

The flaw carries a CVSS score of 9.8 out of 10. An attacker needs no account and no help from a user, and can reach the server over the network. Successful attacks give full control over confidentiality, integrity and availability of the cluster manager, including code execution. Exploitation is confirmed, which makes this a patch-now issue for anyone running an affected version.

What you should do

1. 1Update GPUStack to version 2.2.0.
2. 2Follow the vendor's mitigation guidance if you cannot update right away.
3. 3US federal agencies must apply the fix or mitigations by 12 November 2026 under CISA's directive, or stop using the product if no mitigation is available.
4. 4Follow CISA's forensic triage guidance and check for administrator API keys, users or models you did not create.

Quick facts