EN PT-BR
← Voltar ao feed
critical technology

Critical GPUStack Authentication Bypass (CVE-2026-102895) Exploited in Wild for Reverse Shells on AI Servers

1 fonte(s) · 1 atualização(ões) · publicado 04/11/2026 23:38 · coletado há 1 hora

Attackers are actively exploiting a critical authentication bypass in GPUStack, an open-source tool used to manage GPU clusters for AI workloads. Tracked as CVE-2026-102895 (CVSS 9.8), the flaw allows unauthenticated attackers to gain full admin access by spoofing a loopback IP address, either through a same-host reverse proxy or a forged X-GPUStack-Real-IP header. The vendor confirmed exploitation in the wild against a v2.1.1 deployment, with attackers deploying custom backends to run reverse shells on worker hosts. A second, related flaw, CVE-2026-102894 (CVSS 9.1), affects the SAML login callback and allows session hijacking via forged XML assertions, though no active exploitation has been confirmed for this bug yet.

Entenda a falha

A vulnerabilidade

CVE-2026-102895 (CVSS 9.8) is an authentication bypass in GPUStack, an open-source GPU cluster manager for AI workloads. With force_auth_localhost off (the default), the login logic grants built-in admin rights to any request that appears to come from loopback. An unauthenticated remote attacker gets full admin access, either through a same-host reverse proxy or a forged X-GPUStack-Real-IP header. It affects all versions before 2.2.0. CVE-2026-102894 (CVSS 9.1) is a SAML login callback flaw that allows session hijacking with forged assertions, affecting 0.7.1 up to before 2.2.2. Upgrading to 2.2.2 fixes both.

Como funciona

For CVE-2026-102895, a request reaches the login logic, which checks the source IP to decide whether it is local. If the address is loopback, the server treats the caller as the built-in admin with no password. Behind a same-host reverse proxy, every external request reaches GPUStack with a 127.0.0.1 peer address, so the rule fires for everyone. The same result comes from a request carrying a forged real-IP header. For CVE-2026-102894, the /auth/saml/callback route receives Base64 XML, reads the username and issues a login token immediately, without running the signature, sender or timestamp checks.

Por que é vulnerável

CVE-2026-102895 is an origin validation failure (CWE-346) and IP spoofing weakness (CWE-290): the server trusts a loopback source address, and a client-supplied header, as proof of a local caller, and the unsafe default leaves force_auth_localhost off. CVE-2026-102894 is a missing signature verification flaw (CWE-347): the code never calls the function that validates the assertion. The route is enabled by default even without SAML configured, and used message IDs are not tracked, so replay is possible (CWE-294). Version 2.2.0 removed the loopback auto-admin rule and tightened IP header checks; 2.2.2 added SAML signature verification and disabled unused login routes.

Onde está

CVE-2026-102894 is in the /auth/saml/callback endpoint (advisory GHSA-62m9-f875-rqw6); CVE-2026-102895 is in the GPUStack login logic and the force_auth_localhost setting, with no file or function named.

Como foi descoberta

Researcher Javier Sixto of ulex.fr reported exploitation of CVE-2026-102895 in the wild, and the vendor advisory says it was observed against a v2.1.1 deployment, where attackers used custom backends to run reverse shells. Nikko Enggaliano, Wei Yunzhou, Rui Yang and Haoyu Wang also reported this bug. CVE-2026-102894 was reported by UC Berkeley researchers Austin Chu, Sohee Kim and Corban Villa, and no exploitation in the wild is confirmed for it. Both were disclosed through vendor advisories.

PoC existente, privada

O exploit existe, mas quem o tem não o publicou.

For CVE-2026-102894, the UC Berkeley researchers shared a private exploit tool with the developers; it was not published. For CVE-2026-102895, attacks have been seen in the wild with reverse shells, but no published exploit is mentioned. Because exploitation is already active, patching 2.2.0 or later (ideally 2.2.2) is urgent.

Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 00:15.

Detalhes técnicos

CVE-2026-102895 stems from CWE-346 (origin validation failure) and CWE-290 (IP spoofing) in the login logic. With force_auth_localhost disabled by default, the server grants built-in admin rights to any request appearing to originate from 127.0.0.1, which can be trivially spoofed via a reverse proxy setup or a crafted header. Once authenticated, attackers can steal cloud credentials, mint admin tokens, and push malicious YAML configs to execute code on worker nodes. CVE-2026-102894 resides in the /auth/saml/callback endpoint (CWE-347), which decodes Base64 XML SAML assertions and issues login tokens without validating digital signatures, sender identity, or timestamps; the route is enabled by default even without SAML configured, and lacks replay protection (CWE-294), allowing captured assertions to be reused indefinitely. CVE-2026-102895 affects all GPUStack versions before 2.2.0; CVE-2026-102894 affects versions 0.7.1 through before 2.2.2.

Remediação

Administrators should upgrade to GPUStack 2.2.2 or later, which removes the loopback auto-admin rule, enforces strict IP header validation, and adds SAML signature verification while disabling unused login routes. If immediate patching is not possible, set force_auth_localhost=true, strip all X-GPUStack-Real-IP headers at the reverse proxy, and block external access to /auth/saml/callback at the firewall.

Linha do tempo

  1. securityonline.info ↗ · pub. 04/11/2026 23:38 · coletado 05/11 00:00 primeiro registro

    Critical GPUStack Authentication Bypass (CVE-2026-102895) Exploited in Wild for Reverse Shells on AI Servers

    ler a análise desta fonte

    Attackers are actively exploiting a critical authentication bypass in GPUStack, an open-source tool used to manage GPU clusters for AI workloads. Tracked as CVE-2026-102895 (CVSS 9.8), the flaw allows unauthenticated attackers to gain full admin access by spoofing a loopback IP address, either through a same-host reverse proxy or a forged X-GPUStack-Real-IP header. The vendor confirmed exploitation in the wild against a v2.1.1 deployment, with attackers deploying custom backends to run reverse shells on worker hosts. A second, related flaw, CVE-2026-102894 (CVSS 9.1), affects the SAML login callback and allows session hijacking via forged XML assertions, though no active exploitation has been confirmed for this bug yet.

    Technical Details

    CVE-2026-102895 stems from CWE-346 (origin validation failure) and CWE-290 (IP spoofing) in the login logic. With force_auth_localhost disabled by default, the server grants built-in admin rights to any request appearing to originate from 127.0.0.1, which can be trivially spoofed via a reverse proxy setup or a crafted header. Once authenticated, attackers can steal cloud credentials, mint admin tokens, and push malicious YAML configs to execute code on worker nodes. CVE-2026-102894 resides in the /auth/saml/callback endpoint (CWE-347), which decodes Base64 XML SAML assertions and issues login tokens without validating digital signatures, sender identity, or timestamps; the route is enabled by default even without SAML configured, and lacks replay protection (CWE-294), allowing captured assertions to be reused indefinitely. CVE-2026-102895 affects all GPUStack versions before 2.2.0; CVE-2026-102894 affects versions 0.7.1 through before 2.2.2.

    Remediation

    Administrators should upgrade to GPUStack 2.2.2 or later, which removes the loopback auto-admin rule, enforces strict IP header validation, and adds SAML signature verification while disabling unused login routes. If immediate patching is not possible, set force_auth_localhost=true, strip all X-GPUStack-Real-IP headers at the reverse proxy, and block external access to /auth/saml/callback at the firewall.