Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)
Linked advisories
- CVE-2026-102895GPUStack GPUStack — GPUStack Improper Authentication Vulnerability
- CVE-2026-102895GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
- CVE-2026-102895GPUStack: Umgehung der Authentifizierung durch Spoofing
- CVE-2026-102895GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
- CVE-2026-102895GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py t…
Affected vendors and products
More on Authentication
Other advisories
- HighCVE-2026-124679Authentication bypass by spoofing vulnerability in Apache APISIX.
- MediumCVE-2026-124666Authentication bypass by spoofing vulnerability in Apache APISIX.
- LowCVE-2026-124719Authentication bypass by spoofing vulnerability in Apache APISIX.
- MediumCVE-2026-129152SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because Ans…
- CriticalCVE-2026-129161Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-…
- HighCVE-2026-129162Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to …
- HighCVE-2026-129116C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves Telnet authentication state at AUTH_V…
- MediumCVE-2026-129129AiSOC 12.1.0 before 23.3.0 contains a missing authentication vulnerability that allows unauthenticated attackers to query the enrichment service through Next…
Other news entries
- New SignDrop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM AccessNewsThe Hacker News
- Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication BypassNewsThe Hacker News
- Hackers Deploy Malware in Fresh ScreenConnect CampaignNewsSecurityWeek
- Critical Xen Orchestra Flaws Exploited in AttacksNewsSecurityWeek
- Railway breach leads to $740,000 in fraudulent AI chargesNewsBleepingComputer
- Hackers Exploit Critical Xen Orchestra Auth Bypass Flaw to Gain Admin AccessNewsThe Hacker News
- Critical Xen Orchestra auth bypass flaw exploited to hijack VM serversNewsBleepingComputer
- Authentication bypass by spoofingNewsFortinet PSIRT
Source: https://isc.sans.edu/diary/rss/33514
ID