GPUStack authentication bypass grants unauthenticated admin access
An AI model GPU manager can be entered as admin without logging in!
Summary
A flaw in GPUStack's authentication lets a remote attacker gain administrator access without logging in. Versions before 2.2.0 are affected, and attacks were observed against a 2.1.1 deployment.
Affected when
- force_auth_localhost set to false (the default)
- same-host reverse proxy or X-GPUStack-Real-IP header accepted
What to do
Update to version 2.2.0 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen