Advisories · Technology

gpustack.

Every CVE that names gpustack among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-103002 CVE record

CVSS 8.8 High

GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover
- gpustack
- Broken access control
Not analysed yet 4 Nov 2026
CVE-2026-102894 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover
- gpustack
- Authentication bypass
- Weak cryptography or TLS
Not analysed yet 4 Nov 2026
CVE-2026-102895 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
- gpustack
- Authentication bypass
- CWE-346
Not analysed yet 4 Nov 2026
CVE-2026-58658 CVE record

CVSS 8.8 High

GPUStack Unauthenticated Information Disclosure via Worker Endpoints
- gpustack
- Authentication bypass
Not analysed yet 15 Jul 2026