{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/gpustack--2.2.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:gpustack:gpustack:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-103002"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["gpustack (\u003c 2.2.2)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","authentication-bypass","kubernetes","cloud-native"],"_cs_type":"advisory","_cs_vendors":["GPUStack"],"content_html":"\u003cp\u003eGPUStack versions 2.2.0 through 2.2.1 contain a missing authorization vulnerability in the \u003ccode\u003ecluster_apiserver_proxy\u003c/code\u003e handler. This flaw allows an authenticated non-administrative user to bypass resource-level authorization checks when forwarding requests to a Kubernetes cluster. The vulnerability stems from the proxy handler failing to validate user permissions before forwarding traffic through a worker node using its associated Kubernetes ServiceAccount.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker can leverage the ServiceAccount permissions of the worker node to interact with the Kubernetes cluster API. Depending on the privileges assigned to that ServiceAccount, observed and potential impacts include unauthorized reading of Kubernetes resources, modification of existing workloads, disruption of services through resource deletion, and potential remote code execution by creating attacker-controlled workloads.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003egpustack\u003c/code\u003e to version \u003ccode\u003ev2.2.2\u003c/code\u003e or later immediately to patch CVE-2026-103002.\u003c/li\u003e\n\u003cli\u003eUntil the upgrade is deployed, restrict access to the GPUStack web interface and API to trusted administrative accounts only.\u003c/li\u003e\n\u003cli\u003eReview Kubernetes RBAC roles and cluster role bindings associated with GPUStack worker ServiceAccounts to ensure they follow the principle of least privilege.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-10T16:35:03Z","date_published":"2026-11-10T16:35:03Z","id":"https://feed.craftedsignal.io/briefs/2026-11-gpustack-auth-bypass/","summary":"An authenticated user in GPUStack versions 2.2.0 to 2.2.1 can perform unauthorized actions on managed Kubernetes clusters by exploiting a missing authorization check in the Kubernetes API proxy handler.","title":"GPUStack: Missing authorization in cluster API proxy (CVE-2026-103002)","url":"https://feed.craftedsignal.io/briefs/2026-11-gpustack-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Gpustack (\u003c 2.2.2)","version":"https://jsonfeed.org/version/1.1"}