Attackers Exploit Critical GPUStack Authentication Bypass in the Wild to Run Reverse Shells

TL;DR

Threat actors are exploiting a critical GPUStack authentication bypass in the wild to hijack AI servers. Tracked as CVE-2026-102895 (CVSS 9.8), the flaw lets remote attackers take admin control and run reverse shells on worker hosts. The vendor also patched CVE-2026-102894 (CVSS 9.1), which lets attackers hijack accounts via fake SAML logins.

Why It Matters

GPUStack is an open-source tool that manages GPU clusters for running large AI models. Because these servers hold strong compute power and cloud secret keys, they draw fast attacks from threat actors.

Furthermore, researcher Javier Sixto of ulex.fr reported active attacks in the wild using CVE-2026-102895. As the vendor advisory states, “This vulnerability has been observed exploited in the wild against a v2.1.1 deployment.” In those attacks, intruders used custom backends to run reverse shells on target hosts. Analysts Nikko Enggaliano, Wei Yunzhou, Rui Yang, and Haoyu Wang also reported this bug.

For the second flaw, CVE-2026-102894, UC Berkeley researchers Austin Chu, Sohee Kim, and Corban Villa shared a private exploit tool with the devs. However, no wild attacks are confirmed for that SAML bug yet. While exact install counts remain private, thousands of teams pull the package via pip and Docker Hub.

How the Attack Works

Exploited Loopback Spoofing and Reverse Shells (CVE-2026-102895)

First, CVE-2026-102895 stems from an origin check flaw (CWE-346) and IP spoofing bug (CWE-290) in the login code. By default, the force_auth_localhost setting is false. Consequently, the server grants built-in admin rights to any request that comes from a loopback IP address. An attacker can trick the IP check into seeing a 127.0.0.1 source address in two simple ways.

When an admin runs the server behind a same-host reverse proxy, every outside request arrives with a 127.0.0.1 peer IP. Thus, the auto-admin rule fires for all remote users with no password required. Alternatively, an attacker can send a fake X-GPUStack-Real-IP: 127.0.0.1 header to get the same admin access. As the advisory notes, “Either path yields full, unauthenticated administrative access over the network.” Once inside, attackers can steal cloud keys, mint admin tokens, and send rogue YAML configs to run code on worker nodes.

Unverified SAML Callback Takeover (CVE-2026-102894)

Second, the GHSA-62m9-f875-rqw6 advisory covers another GPUStack authentication bypass in the SAML login callback (CWE-347). When the /auth/saml/callback route gets Base64 XML data, it reads the username and creates a login token right away. However, the code never runs the function that checks the digital signature, sender, or time limits.

Even worse, this route runs on every server by default. As the devs warned, “No credentials are required, and SAML SSO does not even need to be configured.” If an attacker sends a fake XML message naming an existing admin, they get that admin session at once. Because the app never tracks used message IDs, an attacker can also replay a captured login forever (CWE-294).

Affected Versions

CVE-2026-102895 affects all GPUStack builds before version 2.2.0. The active attacks seen in the wild hit a server running version 2.1.1. Meanwhile, CVE-2026-102894 impacts all versions from 0.7.1 before version 2.2.2.

Patch and Mitigation Steps

Admins must update their servers to version 2.2.2 or later to fix every GPUStack authentication bypass. Version 2.2.0 removed the loopback auto-admin rule and locked down IP header checks to stop CVE-2026-102895. Next, version 2.2.2 added strict SAML signature checks and turned off unused login routes to fix CVE-2026-102894.

If teams cannot patch right away, they must apply two urgent blocks at the network edge. First, admins should set force_auth_localhost=true and strip all X-GPUStack-Real-IP headers at their reverse proxy. Second, teams must block outside traffic to the /auth/saml/callback path at their firewall until they install version 2.2.2.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.