CVE-2026-102895

Vulnerability Overview & Technical Description

GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml.

Common Weakness Enumeration (CWE)

Official Vendor Advisories & Technical Bulletins

• NIST NVD Advisory
• MITRE CVE Record
• Advisory (github.com)
• Advisory (cisa.gov)
• Advisory (cisa.gov)