GHSA-GJ9M-F8PH-PMHR GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

Impact In GPUStack before v2.2.0, getcurrentuser in gpustack/api/auth.py promotes any request whose source is considered loopback to the built-in administrator account when forceauthlocalhost is False the default. The "source" is derived by clientipgetter, which can be made to report 127.0.0.1...