CVE-2026-102895

Prior to version 2.2.0 , GPUStack (an open-source GPU cluster manager) is vulnerable to an authentication bypass due to improper origin validation in gpustack/api/auth.py. The get_current_user function treated requests appearing to originate from a loopback source (127.0.0.1) as the built-in admi...

PT-2026-137174

Name of the Vulnerable Software and Affected Versions GPUStack versions prior to 2.2.0 Description An authentication bypass exists where the get current user function in gpustack/api/auth.py incorrectly treats loopback request sources as the built-in administrator when force auth localhost is set...