GPUStack cluster API proxy missing authorization exposes other users' resources
On an AI server management tool, ordinary users can delete others' work.
Summary
GPUStack's cluster API proxy forwards requests without resource-level authorization checks, so a logged-in non-administrator can read, change, or delete cluster resources. Versions from 2.2.0 until 2.2.2 are affected.
Affected when
- Kubernetes-provider cluster with a reachable worker
- Authenticated non-administrator account
What to do
Update to version 2.2.2.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen