CVE-2026-102895

Prior to version 2.2.0 , GPUStack (an open-source GPU cluster manager) is vulnerable to an authentication bypass due to improper origin validation in gpustack/api/auth.py. The get_current_user function treated requests appearing to originate from a loopback source (127.0.0.1) as the built-in admi...