PT-2026-145984

Attackers are spoofing the X-Gpustack-Real-IP header with 127.0.0.1 to trick GPUStack into treating external requests as trusted loopback traffic — bypassing authentication entirely without credentials. Active scanning of AI model endpoints including /v1/models and /v1/messages confirms...