Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:gpustack:gpustack:*:*:*:*:*:*:*:*

2 briefs RSS
high advisory

GPUStack: Missing authorization in cluster API proxy (CVE-2026-103002)

An authenticated user in GPUStack versions 2.2.0 to 2.2.1 can perform unauthorized actions on managed Kubernetes clusters by exploiting a missing authorization check in the Kubernetes API proxy handler.

gpustack vulnerability authentication-bypass kubernetes cloud-native
1t 1c
critical advisory

GPUStack: SAML callback authentication bypass (CVE-2026-102894)

GPUStack versions 0.7.1 through 2.2.1 are vulnerable to an authentication bypass in the /auth/saml/callback endpoint, allowing unauthenticated attackers to assume arbitrary identities, including administrator accounts, by submitting forged SAML assertions.

GPUStack
1r 1t 1c