CVE-2026-102895 GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, getcurrentuser in gpustack/api/auth.py treated a loopback request source as the built-in administrator when forceauthlocalhost was false, which was the default. A remote request coul...